Is there a way to restrict an end user from potentially editing a supervised device through Apple Configurator? It seems that Apple Configurator allows to make undesirable changes to a supervised device, like removing profiles, which would in turn be detrimental to the intended experience on the device, if a user would actually be able to perform such changes.

I have an MDM supervised device with an installed managed app, that activates a content-filter solution to filter traffic system-wide. Is it possible in any way for the user to install a third party content-filter app that would somehow overtake the control of content filtering from my app? I'm asking this because I've tested such a case with my another test content-filter solution and it takes control over content filtering from my content-filter – I think this is possible only because my device is in developer mode, but I'm not entirely sure, and I need a confirmation that it would not be possible to happen in an end used environment.