Prevent users from installing software, but allow Xcode updates

Is it possible to configure macOS for users such that the users are generally prevented from installing applications, but Xcode updates -- inclusive of installing for iOS, Apple Watch, etc., platforms -- is allowed?

We are seeing on this end that users end up with macOS updates, which are installed automatically, along with Xcode updates, and they end up needing administrative approval for the Xcode updates. Looking for ideas on minimizing that, since we would want all Xcode updates approved anyway.