How about running apache chroot'd so what apache thinks is /tmp and what apt-get thinks is /tmp are two different things?
fstab would look something like: (untested) # <file system> <mount point> <type> <options> <dump> <pass> /dev/sdc1 /var/www/tmp/ noexec, blah,blah,blah
