My department has a fleet of about 1000 iOS managed devices. I’m honestly happy not to deal with side-loading. It’s one of the reasons we’re still only on iOS. 

 I think you can block sideloadong  on android by adding it to an organization. People using them in fleets does not justify users not having it 

 You absolutely can.

https://source.android.com/docs/devices/admin

https://developer.android.com/work/dpc/dedicated-devices/lock-task-mode

This guy is costing his company money by purchasing overpriced products.