Another way
Allow people to unlock their phone (jailbreak) for full functionality but set a flag in Secure Enclave to indicate this has been done; then allow it to operate with the ability to side load unconditionally. This flag would be easily detectable by apps as the phone being jailbroken and apps/services which do not want to run on jailbroken phones can then refuse to operate.
Epic gets their third party store and nobody will use it just like how nobody uses EGS on PC today.