SkieCan a student download and install an APK from a website?
No. Unknown sources are blocked on managed devices, so Android will not install an app from a downloaded file. All apps must come from Google Play, and the install guard removes anything not allowed. Unknown sources are blocked globally as well as per app.
Installing an APK normally needs permission for the app or browser that downloaded it to install unknown apps. On a Skie device that permission cannot be granted, because the block on unknown sources is a device owner policy applied globally.
Even if a file did get onto the tablet, Android would refuse to install it. Chrome's download and safe browsing protections work alongside this, and the filtering DNS stops many download sites from loading at all. The student also has no developer options or adb to try another route.
The Play Store itself can be shown or hidden by policy, and the apps that are visible are those the group's list allows. Anything else installed after enrolment that is not allowed is removed silently by the install guard. The baseline snapshot of apps present at setup means existing apps are never wrongly removed.
For an admin, this rule is a default and not something you have to tune. You can verify it in the effective policy for a group and in the compliance score, which reads the protection back from Android.
If a team needs its own app, such as a tool built in house, private APKs are not available yet. Own apps go through the Skie approval flow before they reach a store list. Ask the team about the route for your case.