I guess I posted this on an old version of this thread?
Anyway, we forced setting default apps by using BlackLists in the App Control section to hide/remove the apps we didn't want users to access. This would work well for your use-case, because you are already using the launcher, so you're already using the Work-Managed Mode. Not sure if it would fix your Web launchers though...