Is it possible in Android to prevent users from installing any app that is not explicitly listed on a firm based whitelist?
Yes, these apps are called "Device administrators". You use the Device Administration API to write device admin applications that users install on their devices. The device admin application enforces the desired policies. A system administrator writes a device admin application that enforces remote/local device security policies. These policies could be hard-coded into the app, or the application could dynamically fetch policies from a third-party server.