The header will prevent resource files from being loaded from anywhere except the source domain.
However, it will not prevent man-in-the-middle or browser hijacks which may dynamically insert changes to the page itself since those are not trying to load a separate resource file as far as the browser is concerned.
Header set Content-Security-Policy "default-src 'self'"
Is indeed the correct Apache .htaccess entry.
To prevent MiTM hijacks, you need to make sure that all resources are delivered encrypted over HTTPS. Use certificate pinning to help prevent MiTM decoding.
To prevent browser hijacks, firstly ensure that all clients have robust ad-blocking installed and updated (if you are on a controlled network, do this at the network level). That prevents drive-by hijacks which are increasingly common. Other forms would come from malware on the PC so ensure that users have constantly updated anti-virus and are familiar with attacks such as phishing, not opening untrusted documents and never running applications unless known. the usual client security stuff.