macOS does precisely that out of the box, doesn't it? You have to change some settings to run other software. I've got it set to: allow notarized, warn for internet downloads (even if notarized), everything else after explicit permission.