I would say they should use GrapheneOS, but I don't think they have an MDM solution.

Here is the text in case it paywalls. Can't seem to archive because the full story has to be expanded.

https://paste.to/?ee474ac7c6f11de0#Ctdsr8Y6Dsx7Wj4jTn1f8G99X...