You are right, better locking them out of the Play Store, there's too much risk using it.

We could also imagine a 24h delay to get Play Store access