Firefox already had a very mature policy management engine, it just didn't have a nice gui and would require like ansible or something to use.

It allows forcing specific extensions on, and allowing user installs is a flag.

I use the policy engine on nixos to install some plugins and disable some of firefox's dumber features.