Android has multiple options for MDM - the mess invasive one has a completely separate work profile that should not give the org that kind of access.