How they will do it likely is they will charge to install the App store app and assign it a CA and require it to sign the apps downloaded from that app store.

The sideloading of apps will technically be an apple approved app but enforced by another app store. To put it another way you would not be able to randomly download an unsigned app.