How can I disable new plugin and theme install, but allow updates?

This would probably make a job done, although using die is not the pretty way

add_filter( 'upgrader_package_options', function( $options ) {

    if (
        isset( $options['hook_extra']['action'] ) &&
        $options['hook_extra']['action'] === 'install' &&
        isset( $options['hook_extra']['type'] ) &&
        in_array( $options['hook_extra']['type'], [ 'plugin', 'theme' ] 
    ) {
        die('Plugins & Themes installation disabled!');
    }

    return $options;
} );