You're reinventing the wheel
Except...your wheel is square.
It looks like your current group policy settings are already pointed in the right direction. Using hashes are only one option, however.
Disallow execution by default.
If it's in a trusted directory, allow it (They can't write to "C:\Program Files" or such, of course...you do have proper directory permissions, right?)
If it's signed by a trusted publisher, allow it (different than hashes, less annoying).