Locking exe

Yes you can lock any .exe that is started by the Windows Explorer process. Any .exe started by the system cannot be locked. Also you must block access to the command prompt as well, since it could still be used to start the programs. This can alsobe done using group policy.

The setting you're looking for is found under User Configuration/Administrative Templates/System/"Run only Allowed Windows Applications"

For MSI you can specify not to allow any msi files or only unmanaged ones. This means you can publish certain .msi files on the network;users can install these. And block all unauthorized .msi files.

This setting is found under Computer Configuration\Administrative Templates\Windows Components\Windows Installer\"Disable Windows Installer"

Hope this Helps