A company or school can already do this easily, by the way, by setting a boot-loader password and restricting admin access. Notably, this are normal macOS functions, you don't need a fancy mtm setup.
IANAL, but I really don't think so. On a company laptop, the company owns the laptop, and the company can lock it down as much or as little as they want.