really?
linux/android/ios aren't vulnerable? did you really just say that?
Also, if a user _can_ use their device from outside the office to "do business", what would be more secure about having them do it from the company wifi? What difference does being "on premises" make in that context? It seems to me that if you can get away with _never_ having them on the internal network, and still do their business effectively in a secure way, that's the best of both worlds.