In order to define rules based on network interfaces, you will need to upgrade to CSA version 5.2.
CSA version 5.2.0.238 comes with a Data Theft Prevention rule module. You could clone that module and customize to your liking.
In my experience, the best way to tackle item 3 is to develop a list of authorized applications and only allow those to be installed, while denying all other installations.