hmmm What are first party sources? Apps installed by the owner?
Pretty sure it means the GOS App Store and (maybe) Google Play. At least that makes the most sense.
If I disable app installation with updates for a user, I can't push any apps to them. Does this mean that updates will also not get pushed?
Apps are always updated device wide, as part of Android's downgrade protection.
Is the basic idea that I enabled installations to push them from the owner profile and then disable them if I want to keep user profiles from installing apps?
You can always disable Install unknown apps in the specific Info screen of an App Installer. That way, apps can still be pushed by the Owner profile, but apps cannot be installed by Google Play / Fdroid / etc.