How can I prevent installation of NEW applications on an Android 5.1 device, but keep auto-updates of existing applications?

Question

We will soon have to provide a phone to a person who is obviously not familiar with IT stuff at all, and not capable of learning anything about information security, etc. (and probably not capable of learning anything really) They must have ability to communicate with us and there will be no one near them to "repair" the device in case something gets really broken.

I thought that it will be a good idea to provide them with a couple of necessary applications on the device and then block installation of any other new apps (both from Google Play and from anywhere else). However, the standard auto-update process of Google Play should be working (at least because otherwise messaging/VoIP apps will soon become obsolete and stop working, and for security reasons, too)

So the question is â€” what are the possible solutions to prevent the user from installing non white-listed applications?

Also, we think that the person will not try too hard to circumvent the restrictions. So, maybe even a simple solution (just hide all unwanted icons, including Google Play, from the launcher / app list) will do, but this is risky, and I am not sure that is possible with all kinds of stock UI. So it's interesting to know if there are any better solutions.

Update

Solutions which do not rely on the fact that the user doesn't know (their only) PIN/password are preferable, because a working screen lock can be useful to reduce damage caused by device loss/stealing.

— Display Name | Sources

Answer

There are multiple approaches you could take:

a kiosk-mode solution. That would pin the user to a certain app or group of apps defined as "kiosk"

parental-control apps, which are often a specific variant of kiosk

use an App-Locker

The latter most likely is the approach best fitting your current case: You can define which apps should be "locked down" and which not. Locking e.g. settings and the Playstore app, while unknown-sources are disabled, would prevent any new installations. With auto-updates enabled in the Playstore app, these would still be applied automatically.

For additional details, be welcome to click the tags (for questions using them), or take a look into the corresponding tag-wikis: kiosk-mode, parental-control, unknown-sources.

Note that, to prevent installations via the Google Play web interface, the user must not have the credentials of any Google account linked to the device (no chance otherwise).¹ These do not necessarily correspond with the lockscreen PIN/password/pattern, so this is no contradiction to your requirements.

^{1: credits to Firelord for pointing this out}

— Izzy | Sources

How can I prevent installation of NEW applications on an Android 5.1 device, but keep auto-updates of existing applications?

Update

Topics