If it's like the locked down laptop I had to work on in a recent role, running a portable browser is not an option. Everything had to be installed by admins via "service now" requests. It wasn't a particularly efficient process to set up a machine... but for security/compliance reasons, practically nothing was allowed to happen below the radar.
Live drives are still a thing.
However the optimal solution is to keep work and personal completely separate.
Some places just block all executables that aren't explicitly approved.