Restrict apps to a whitelist, managed remotely

What's the best way to restrict my Android devices to only use approved apps? I want to manage the whitelist remotely.

Bonus points if I can keep everything in-house, on my home server or similar via my existing VPN.

This is for my kids' future phones. Ages 12 to 16.