Is it possible to prevent executables or portable apps from being downloaded in a corporate environment on the network layer? (i.e not some agent on a host preventing it) Would this require MITM SSL certificates being installed to dissect to the traffic? I can imagine that there are solutions with deep packet inspection to prevent them from being downloaded if sent in cleartext (over HTTP or FTP for example).
In short, what is good practice to prevent users from downloading executables? I know that for installing/running them one can whitelist applications, that is not the question.