One option is to use Blackberry Work[1] which gives your it department just control over an encrypted container, not the whole phone.

[1] https://www.blackberry.com/us/en/forms/campaigns/q2_19/byo