We have applications that install via NAL, but as the msi packages contain
setup info like serial numbers, should users be able to browse to
SERVER/APPS/ and view all the packaged msi files?

What file rights should be applied, and would they be applied to the
application object or elsewhere?