When I worked on azure compute we had dedicated laptops that were basically bricks. All they did was connect to production. No internet no admin rights limited set of software. This is a pretty reasonable security move.

This approach from google is basically the opposite. No internet on your workstation but your laptop works like normal.