Apple configurator 2- prevent users deleting apps

For an organisation we set ipads/iphone's in supervise mode with Apple configurator 2 and during this stage MDM control Apps are been installed trough VPP licensing and the device will automatically added to the Sophos MDM.

If we set in the Apple configurator profile restrictions that users are not allowed to remove apps, they can't remove any app. Even apps they have download from de appstore , can't removed. This is not what we want.

If we set users are allowed to remove Apps, they can remove the MDM control Apps installed by the Configurator.

How do we prevent users deleting the Apps installed by Apple configurator, but make it possible to remove all other installed Apps?