How do allow misexec.exe to run?
You can't run an .msi from the command line because it blocks cmd.exe from launching msiexec.exe.
You can't double click the msi because it blocks msiexec.exe from being called from explorer.exe.
How do you allow this to run?
Just read your post... not too sure if you figured it out, but I would add msiexec.exe as an updater in your Application Control rule groups that are assigned to that particular server or workstation. I believe this should work.