I see that one of the restrictions for iOS devices is to remove the ability to install apps, which completely removes the App Store app from the iOS device. However, this also removes the ability to install apps that are published in the LD Portal.
Is there a way to allow the LD portal to install apps even when that restriction in in place?
(Our goal is to allow only approved apps to be installed on devices.)
Currently no. If you restrict users from installing apps, the only way you can deal with approved only apps is to force them to get the password each time (huge pain) or pre-load them on the device before deployment via Apple Configurator etc. (Somewhat of a pain depending on number of devices). Also keep in mind that anything you preload under what I assume will be a company apple id, you will have to give out that apple ID password or manually touch each device in order to keep apps updates.
Currently LDMM doesn't offer a nice way to handle this.