Comment by bonzini

Are they using work profiles on Android phones of employees that need mobile email access? It is a very good solution that lets the employer administer only a separate identity and gives them no access to personal stuff. The only global thing that the employer can do is enforce a certain level of security (for example requiring a PIN on the lock screen and data encryption).