Security people always want to "set policy" "educate on practices" and "enforce". You've already lost the battle.

PROVIDE SOLUTIONS.

Here you go: https://qubes-os.org