When you say restrict, what do you mean exactly? If you think about the development process, a user develops and app. They add an extension. Then they publish to a stream. There is not something in place that would stop the user from doing so by checking the app to see if there are unapproved extensions.
You could however, limit which extensions render or which users have access to them. You can do so through security rules.
See my previous post here.
