If I understand your question correctly, I'd say: Strategically default to sourcing apps from the Microsoft App Store (new) first. Next, if you have the budget then you'd get something like Intune Enterprise App Catalog to look after other apps not in the store. Other app packaging/catalog services exist. Where there is a budget constraint, you could consider using winget but it can be a steep learning curve and you'd have to automate it yourself, perhaps with Task Scheduler.