Do you know of a way (e.g. a custom profile/payload) to completely block/prevent a certain already installed app (like Zoom.us) on an Apple macOS device from running?
Many thanks for your help!
If you create a Restrictions Profile, there's the option "Restrict which applications are allowed to launch" which let's you Disallow Folders.
Given that the ".app" files you see on your /Applications folder are technically folders as well, you can disallow an App by pointing to it (e.g. "/Applications/FaceTime.app").
This will not remove or hide the App from the device, but it will require an Admin account in order for the app to be launched.
Hope this helps.
That is a good hint, unfortunately app's doesn't act like folders, so it doesn't touch them at all. Also, if this option is activated, the Workspace One Intelligent HUB is not installed under certain profile conditions with "Restrictions" in the enrollment, or it avoids it from working.