The best way is to use a Settings Catalog policy "Turn off store application". It still allows you to Install Store Apps from the Company Portal App. Refer to this blog post, for more detailed information about this subject: -to-disable-microsoft-store-in-windows-using-intune/