Block launching Azure VMS & VMSS from Azure marketplace

We are planning to block launching of VMs & VMss from azure marketplace and allow only shared image gallery via azure policy , below is the one which i created, please suggest is there any more parameters to consider blocking from market place?

{
    "properties": {
        "displayName": "Block VM or VMSS creation other than Trusted images",
        "description": "This policy enables you to restrict VM & VMSS creation from market place",
        "mode": "Indexed",
        "metadata": {
            "version": "1.0.0",
            "category": "Compute"
        },
        "parameters": {
            "publishersToExclude": {
                 "type": "Array",
                 "metadata": {
                      "displayName": "Excluded Publishers",
                      "description": "An array of publishers to exclude from evaluation, such as NVAs"
                 },
                 "defaultValue": [
                      "cisco",
                      "microsoft-aks",                     
                      "microsoft-ads",
                      "AzureDatabricks"
               ]
            }
         },
        "policyRule": {
            "if": {
                "allOf": [
                    {
                       "field": "type",
                       "in": [
                            "Microsoft.Compute/virtualMachines",
                          "Microsoft.Compute/VirtualMachineScaleSets"
                        ]
                    },
                    {
                       "field": "Microsoft.Compute/imagePublisher",
                       "notIn": "[parameters('publishersToExclude')]"
                    },
                       {
                       "not" : {
                           "anyOf": [
                         {
                           "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.id",
                           "contains": "Microsoft.Compute/galleries"
                         }
                       ]
                    }
                  }
                ]
            },        
            "then": {
                "effect": "deny"
            }
        }
    }
}

I tried to block market place images and its working as expected, checking if the policy is correct or anything more parameters needs to consider to block market place completely

I tried to block market place images and its working as expected, checking if the policy is correct or anything more parameters needs to consider to block market place completely

Your policy restricts the creation of VMs and VMSSs from the Azure Marketplace, except for trusted images in the shared image gallery.However, there are a few other parameters that you may want to consider adding to your policy to further restrict the creation of VMs and VMSSs.

You can restrict the creation of VMs and VMSSs based on the SKU and Offer of the image used. For example, you may want to allow only certain SKUs and Images that are approved by your organization.

Here is the updated policy .

    {
      "mode": "Indexed",
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "in": [
                "Microsoft.Compute/virtualMachines",
                "Microsoft.Compute/VirtualMachineScaleSets"
              ]
            },
            {
              "field": "Microsoft.Compute/imagePublisher",
              "notIn": "[parameters('publishersToExclude')]"
            },
            {
              "not": {
                "anyOf": [
                  {
                    "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.id",
                    "contains": "Microsoft.Compute/galleries"
                  }
                ]
              }
            },
            {
              "not": {
                "anyOf": [
                  {
                    "field": "Microsoft.Compute/imageSku",
                    "in": "[parameters('allowedImageSKUs')]"
                  },
                  {
                    "field": "Microsoft.Compute/imageOffer",
                    "in": "[parameters('allowedImageOffers')]"
                  }
                ]
              }
            }
          ]
        },
        "then": {
          "effect": "deny"
        }
      },
      "parameters": {
        "publishersToExclude": {
          "type": "Array",
          "metadata": {
            "displayName": "Excluded Publishers",
            "description": "An array of publishers to exclude from evaluation, such as NVAs."
          },
          "defaultValue": [
            "cisco",
            "microsoft-aks",
            "microsoft-ads",
            "AzureDatabricks"
          ]
        },
        "allowedImageSKUs": {
          "type": "Array",
          "metadata": {
            "displayName": "Allowed Image SKUs",
            "description": "An array of allowed image SKUs."
          },
          "defaultValue": [
            "allowed-sku-1",
            "allowed-sku-2",
            "allowed-sku-3"
          ]
        },
        "allowedImageOffers": {
          "type": "Array",
          "metadata": {
            "displayName": "Allowed Image Offers",
            "description": "An array of allowed image offers."
          },
          "defaultValue": [
            "allowed-offer-1",
            "allowed-offer-2",
            "allowed-offer-3"
          ]
        }
      }
    }

You can select the Image SKU's and Image Offer as per your requirement.

This will restrict the creation of VMs and VMSSs to only those images that match the specified offer and SKU.

The policy is blocking all SKUs except the specified ones.