I would say they should use GrapheneOS, but I don't think they have an MDM solution.