Google has this neat implementation on Android where your work applications end up in a seperate profile that the company can manage. They can erase that profile but they can't see or manage any data outside of it.
This is the only way I'll ever allow work things on my phone.
Are there instructions on this anywhere? I get really annoyed at the MDM from my work email, which I can just get through the browser, but without it set up, I can't get work calendar notifications, which I do actually need.