Knowing InTune MDM setup, it has two modes, control a few apps or control entire phone. iOS will tell you during setup what's happening and I've been at plenty of companies where employees are told "It's just for our apps" but it's really full Device Control. $TwoCompaniesAgo tried that "It's just for our applications" but when I went to install it, iOS went "This is 100% full device control" and I rejected it.