You could allow access to Safari and apply a Web Content Filter to whitelist the sites you would like access to (i.e. app store, etc)
Also using your DEP account you can signup to VPP (Volume Purchase Program)
Direct link: https://vpp.itunes.apple.com/WebObjects/MZFinance.woa/wa/login
Note; if you plan to have more than one environment then consider creating separate admin accounts inside DEP and use these to distribute VPP (VPP accounts do not share purchases and should only be deployed to one platform to avoid application licencing issues)
Once you setup an account you can integrate it with Core/Cloud and then purchase your apps using Managed Distribution (this is an option when purchasing via the VPP portal)
The VPP integration with Core/Cloud will periodically grab a list of licences, you can then distribute the applications as “Device based Licenses” allowing the app to install silently on a supervised iOS device.
Note: non-supervised devices can also benefit from this distribution, however they will get a prompt to install the app (this does not require an AppleID on the device)