> And you don't want the users to start random software

python ~/my.py

wget | bash

I guess you wouldn't install wget in that installation and patch programming languages to follow the executive bit or also remove them.

Also you can't make it physically impossible for employees to not e.g. screenshot things and take them home. You can forbid it and try to enforce it, but some amount of trust is needed.

Willing action needs to be taken for what it is, an deliberate action by that user. If that user is allowed to access that data, than I don't see what is wrong with him doing that in an automated way.