block programs or application as altiris
I suggest that you can block software from SCCM. Altiris does this procedure and this is a characteristic that they have
Nash Pherson (MVP) commented
Another way to approach this would be to provide UI for configuration items that handle AppLocker white-lists and Device Guard white lists, as well as enabling/disabling the features overall.