It's totally possible to have both: on first init, have the user choose whether they want to prevent installing apps from 3rd party stores. Changing this setting requires performing a factory reset.

Problem solved. If you want the walled garden, opt in at the beginning, and now your children/grandmother are safe as long as they don't literally reset their phone, wiping all their pictures/apps/whatever.