Prevent application running from windows temp directory

At one of my past companies they had implemented a policy in McAfee (so I'm assuming this is possible in Symantec) that denied users the ability to "Run" an application from the temp directory when they downloaded a file.  If you wanted to download a file and run it then you had to download that file to your local PC first and then you could run it.  If you tried clicking the file download and selecting "Run" as opposed to "Save As" you would get an error stating you did not have permission to run the file from the Temp directory.  Does anyone know how to accomplish this in Symantec?