This, unlike the "chmod 444," solution will let extensions update.
You can also allow safe extensions that aren't currently installed (but may be later) and the user can remove extensions in the Allow list if so desired (although there is a ExtensionInstallForcelist to stop that too).
https://support.google.com/chrome/a/answer/7517624?hl=en
https://chromeenterprise.google/policies/#ExtensionInstallAl...
This, unlike the "chmod 444," solution will let extensions update.
You can also allow safe extensions that aren't currently installed (but may be later) and the user can remove extensions in the Allow list if so desired (although there is a ExtensionInstallForcelist to stop that too).