Your organization wants to deploy App Control for Business (formerly WDAC) to a group of Windows 11 workstations using Intune. Security wants to ensure that only Windows components, Microsoft Store apps, and software installed by the Microsoft Configuration Manager and Intune managed installer are allowed to run. However, the desktop team is concerned that a full enforcement rollout could block business-critical line-of-business applications that have not yet been catalogued. What should you configure first to satisfy both requirements with the least risk of disruption?