> The reason I can't use Tailscale at work is because it routes traffic through servers we can't control.

You can run your own DERP servers and exclude the Tailscale ones even if you don’t run your own Headscale server: https://tailscale.com/kb/1118/custom-derp-servers