If you own it, don’t install a damn thing your employer demands. If they want security access on a device, they pay for it.

If you don’t own it, don’t use it for a damn thing that isn’t work-related and use it minimally for that. “Yes sir” emails and submitting reports. That’s it. Don’t do research, don’t surf the web, don’t accept a single personal call, email, or text. They don’t have any right to know anything that is not work related.