to whitelist things in an enterprise environment youre going to want to enroll your macs with DEP and push a profile with MDM