Former Mac admin here. I never locked Gatekeeper down that strict, but I did enforce the setting where if you just double clicked some nonsense, it would it let you open it. You had to right click and then open from the context menu and blow through the warning. Ultimately I depended on our endpoint protection software and Jamf inventory to keep things clean. Jamf I could setup to alert me on known malware/bad shit, or in this case, specific versions of apps so I knew who I needed to reach out to, and then endpoint protection for everything else. Good enough for our HIPAA auditors.