Securing existing office devices to best practices

Hello everyone.
I am looking for feedback and help with securing and managing our company devices and network.
I am starting from the ground up here. With an existing company. I work in Ireland so I have to comply with GDPR and Irish regulations.
We have 60 employees in 2 offices mixture of window and Mac devices.
Not sure where to start and how.
I know I have to encrypt all devices, set password policys …
This all needs to be done on existing machines with the least disruption.
I have had a look at a service called cloudjump which can do a lot but is quite pricey.
Should I instead set up our own LDAP on site.

Thanks