Software Deployment

I am looking at a solution that would lock down Windows Installer so that we can enable the always install elevated policy. When I look at the Disable Windows Installer option I see that you can can configure Windows Installer to only run managed apps. What I am trying to determine is what is a managed app? Does that mean software only exclusively deployed via Active Directory? Only signed MSIs? Ideally I would like to deploy only signed MSIs by Active Directory or by a technician.