In the end when supporting the non tech people in the family, what I would really like is to setup their device so they can install anything on Fdroid but nothing from the play store (unless approved by me) nor direct from an apk.

This is exactly what I do. Works pretty well. I've never needed to restrict the play store. I just tell them not to use it.

I wonder if MDM can do that.