I also had a similar issue at work, where the company I work for is planning to release a smartphone preloaded with its own videogames and dedicated apps.
https://stackoverflow.com/questions/47457564/forward-locking-and-protecting-apks-in-custom-rom
I'll leave the question here with no expectations of altruism from anybody here just in case you have ideas of how to avoid kiosk-locking our device.
One of the approaches I was thinking of was using an app list like yours, F-Droid, ApkMirror, etc. to at least give the user the chance to download some apps outside of the included ones.