I'm having a worrying issue with Windows 10 setup just now.
All of our company machines have the SmartScreen/EnableAppInstallControl policy deployed to them using Intune. This prevents users from installing apps that aren't in Company Portal or Windows Store.
Start > Settings > Apps > Allow apps from the Store only
If a user downloads say Google Chrome. exe they should get 'Your PC settings' message which then directs them to the Store however on some devices, users are getting a 'Search for the app in the Store' message and then it lets them install the app!!
Tested devices are on the latest build of 1709 with the same polices applied.