I also have a hunch that if your webserver is prepared to serve HTTP then it may be sufficient to make some server-side settings in Portal on your Caché / Ensemble server, as follows.

The settings are WebServerName, WebServerPort, and WebServerURLPrefix. These can be found in the Startup Settings ([System Administration] > [Configuration] > [Additional Settings] > [Startup Settings])

Doing this may mean you don't need to get each Studio user to change their settings. But it seems possible the server-side settings won't be able to make Studios use HTTPS for templates and add-ins rather than HTTP.

As noted by Keith Avery in his comment, the ListAll classmethod of %SYS.Namespace may also include implicit namespaces. This is mentioned in the class doc. I haven't verified, but I guess that you may get different results from ListAll() if you run it once immediately after Cache startup and again after Portal has been used to change namespace definitions (e.g. mappings).

ListAll() is implemented using calls to the undocumented $ZUTIL(90) function. I dug up some WRC information we received in 2010 about a change in behaviour in that function starting with Caché 2010.2. The summary was:

SML1081 - Support single namespace activation and reduce usage of mapping memory.