well if they don't manage it via some kind of MDM software, that would mean the employee is responsible for security on his own - at which point he might as well use his private laptop for work stuff.
The BIOS/firmware would have to be locked down and disallow USB/etc. booting, I don't think that's normally covered by MDM? Does UEFI even expose an ability to control that via software?
