Follow up: How to write a Linux virus

.desktop files tell the desktop environment how to handle other files.
So I think having a set list is not what you want.

Limiting the ability to add .desktop files to the system without specific effort is I think what you want. I don't believe "I dropped a .desktop file on the screen" should be sufficient to reconfigure the system, nor enable arbitrary commands to be run with a simple doubleclick.

Of course, I also don't think doubleclicking a program should launch it, but that's another discussion.