John564479 I believe that is a commonly recommended method actually. As far as I understand, disabled apps can not run in any way and essentially can be counted as you would an app that isn't installed. I guess, technically, there is a very short time between when an app is installed and when you disable it, but that's grasping at straws really.
It's a good method, that lets you slightly reduce your attack surface by running apps in user profiles, and let's you keep them updated and easily distribute them to user profiles, so thumbs up I think :)