Running of programs

It's possible that Firefox does not use Windows installation procedure, but simply downloads the files. We will investigate this.

Basically, there is no way to prevent Firefox from installing without disabling downloads because the FireFox install does not use the Microsoft MSI installation process. This is the process that Secure Lockdown disables when the "No App Install" option is enabled. The only way to prevent the FireFox install is to not allow downloads as IE will always allow you to run what you download. Note that there are many other threats aside from installations exes if you allow the download option. In your setup, it seems you need to disable that feature if possible.

The other option is to limit what sites your users have access to using the Secure Lockdown > IE Lockdown > Allowed Sites feature.