Blocking installation files

Hello guys, I have a question. We've set up Intune for students and they all have their own devices. We have the necessary things blocked except for 1 thing.

How do we block students from downloading and installing .exes? We can't disable downloading overall because they still need to be able to download pdf files etc.

Same goes for .exe's. I've looked around and its all about blocking certain .exes. I can't make a list of all the possible .exes they might download and install. And if I disable windows installer it will block firefox.exe and such as well. Anybody who has done this before or knows how to do this?

Thanks in advance!