Blocking Access to MS Store and Xbox apps - sanity check, please!

[555tech]

Investigating blocking the Windows Store in W11 for pupils at a few schools due to safeguarding concerns with some of the content available on there. All schools use Windows in a local domain and AD to log in. Annoyingly some schools use W11 Edu and some W11 Pro.

 

For Edu i'm looking at using the "Users > Policies > Admin Templates > Windows Components > Store > Turn off the Store application" GPO, aimed at the pupil OU, to disable access for pupils. However, I have a colleague who thinks that this completely nerfs the store removing the store system apps' ability to update. I wasn't aware this was the case. I can't seem to find any official MS advice about this specific scenario but this MS Community forum thread appears to suggest this GPO still allows apps to update while blocking user access. Is this correct? Has anyone here successfully dealt with this situation?

 

For Pro it's via "User > Policies > Windows Settings > Security Settings > Software Restriction Policies > Additional Rules" and specifying the path of the Store package. Does targeting the users here also allow apps to update or will this stop this functionality, too?

 

Also, Xbox apps. Have tested Applocker for Edu devices but blocking them this way had some unexpected consequences... The desktop taskbar notification tray stopped being responsive! How are others managing this?