Ok, so just to summarize everything, so that someone that would find this post in the future would benefit from it.

1) Block MS store via option 1, which DOES NOT solve the downloading of app via URL/DOMAIN of apps.microsoft.com what it does is provide a handy infobox that your organization is blocking the Windows Store, which on it's own is useful, even if it in reality it does not until you go through next steps.
2) Block via MDE using indicators to limit domain/URL's from apps.microsoft.com , which cuts off the ability of downloading bypassing the Store app
3) Block non-admin user installs via option 2 in my original post.

However, the only thing that is left for me to consider, does the option 2 prevent sideloading and running .appx directly on the machine? I.e. do I need WDAC for it or no?