Your only options are: allow google play, get the apps from Samsung (if they allow this) and load them as internal apps or side loading from unknown sources.
If you have blocked google play you could try option 2; have you tried approaching Samsung directly to get the actual apps then loading them as internal apps. If this is what you meant as apk and dont like this route then the only other method is side loading which is complicated and not recommended as this will only get you back to the same point. This would involve using a different download source and allowing the Samsung device to download from unknown sources; dont recommend this method.
a different method may be to allow google play at strategic points in the calendar (you can set this by compliance rules in workspace) then close the access again after a set period and finally have the compliance rule look for anything you do not want installed and either flag this as non compliant so you can contact the employee or have the rules uninstall whatever you are not happy with. This is a complicated method, would involve a lot of API coding and time but would get round the side loading or internal apps methods.
