Comment 7 for bug 90085

I'm not an expert, but I'd try adding these two lines to /etc/apt/apt.conf:
   DPkg::Pre-Invoke {"mount -o remount,exec /tmp";};
   DPkg::Post-Invoke {"mount -o remount /tmp";};

This should remount /tmp as exec long enough for preconfigure packages with apt, then remount again as noexec after finished installing.

Alternately, I believe something like this would work as well in case you'd prefer to avoid remounting.
   APT::ExtractTemplates::TempDir "/var/tmp";

(In this case, /var/tmp would have to be mounted as exec though.)