A Cloud Access Security Broker (CASB) would best meet the requirements stated in the scenario. CASBs can provide visibility into which cloud applications are being used across a company, restrict data that is uploaded to the cloud, and prevent unauthorized downloading of company applications for personal use. They act as a gatekeeper, allowing the organization to extend its security policies beyond its own infrastructure. CASBs provide features like visibility, data security, threat protection, and compliance, ensuring secure and only authorized use of cloud services by employees.