Exactly, allowing employees to install pypi packages from the internet isn't different to allowing them to install any software from the internet.