You can turn on parental controls and select which apps a user can execute, either per checkbox or (if they are from the App Store) based on age ratings.
Parental controls will, however, disable installing apps for the user completely. They get a prompt asking for the admin password. As far as I can see there is no way to enable users to only install apps from the app store. By the way, there is such an option in iOS.
I don't think anyone ever complained about them adding options to the parental controls, so Apple could absolutly add an option to install only App Store apps to the parental controls.
Parental controls will, however, disable installing apps for the user completely. They get a prompt asking for the admin password. As far as I can see there is no way to enable users to only install apps from the app store. By the way, there is such an option in iOS.
I don't think anyone ever complained about them adding options to the parental controls, so Apple could absolutly add an option to install only App Store apps to the parental controls.