If so, how can I disable the ability to sideload apps while still being able to update apps already installed?
Disabling the package installer would prevent apps from making the user request to install an app. Technically, they would still make the request but it would not show up, with the installer being disabled. That said, if a system app has INSTALL_PACKAGES permission (such as Play Store) or a third-party app has root access somehow, disabling the package installer would make no difference. Similarly, disabling it would not prevent sideloading from adb.