It should be noted blocking execution isn't the problem, its the access an unknown executable has to the host system.

A well hardened MAC system, which requires no effective user intervention, can limit access of arbitrary programs to a minimal set of files and devices to stop bad actors from actually getting anything without the user having to modify the MAC policy.