Unable to install apk after device provisioning (Android 8.0)

We are developing a COSU app using Android Management API and QR code provisioning. We're planning to distribute app with private Google play, but for now I'm trying to make it work with manual installation using apk. That's how it should work:

1. A client receives qr code from us, that applies policy without restrictions to the device.
2. After provisioning client downloads apk from some other source (probably via email) and installs it.
3. Client applies policy with restrictions from app with call to API.

So, I'm stuck on second step - an attempt to install downloaded apk leads to this error:

Default policy seems to be ok:

  {
   "name": "enterprises/<enterpriseName>/policies/policy_unlocked",
   "version": "11",
   "applications": [
    {
     "packageName": "com.axmor.fsinphone",
     "installType": "AVAILABLE",
     "defaultPermissionPolicy": "GRANT"
    }
   ],
   "persistentPreferredActivities": [
    {
     "receiverActivity": "com.axmor.fsinphone",
     "actions": [
      "android.intent.action.MAIN"
     ]
    }
   ],
   "systemUpdate": {
    "type": "WINDOWED",
    "startMinutes": 120,
    "endMinutes": 240
   },
   "debuggingFeaturesAllowed": true
  }
 ]
}

And this policy is applied to device:

   "policyName": "enterprises/<enterpriseName>/policies/policy_unlocked",
   "appliedPolicyName": "enterprises/<enterpriseName>/policies/policy_unlocked",

What I've tried:

1. Installing release apk and signed apk (same result)
2. Installing apk with adb from Android studio - this works, but it's not what I want.

(copying the solution here from comments)

To be able to install apps from outside the Play Store you need to set installUnknownSourcesAllowed to true in the Policy. More details in the policy references.