This question offers itself to a variety of approaches, because it seems that you are relying to an unknown extent on your user's lack of dev savvy.
A) Simplest: if your user is not an android tech, and you have no app store installed on the device, why assume that they know what an apk is and where to obtain one?
B) however, if you think that thats too simple , you can disable unknown sources and hide the setting from the user, (that should work on a reg phone, though not sure about lineage OS.) adb shell pm uninstall -k --user 0 com.android.settings.<settingName>
to disable a particular setting has been known to work on some devices, you can try it on the package manager as well, as it does not remove the apk from the phone just de-registers, though a factory reset will return the setting, and you'd have to look into preventing the user from performing factory resets.
there are many approaches that would offer a similiar level of protection.
C) Therefore, (if you think a non-dev user will figure that out,) it seems that parental control apps and/or app managers would be the most complete basic level protection.
D) you can get super deep and play around with the OS - possibly recompile the package manager app.
in summary: at the end of the day android requires pm in order to function properly. the packageinstaller app that comes preloaded with your firmware is only one of the many ways to install apks on your device because it is only a UI for a native android functionality which doesnt disappear when the package installer app is removed. to fully and irreversably disable this functionality in a way that only very experienced dev cannot circumvent is a very complicated job. However an app manager or parental control solution can usually offer near complete security from an average user.