I hate that as an admin, I have that power instead of just restricting my ability to remove company email/calendar/contacts only. I have a handful of senior exe

I hate that as an admin, I have that power instead of just restricting my ability to remove company email/calendar/contacts only. I have a handful of senior execs who do not want a company phone (or rather give up their personal phone), still want to access company email, but do not want to install MDM because it allows me to completely wipe their device or perform other system-level stuff. All I want as the admin is to (1) authorize if a device can be used to connect to company resources (2) require minimum level of security (pin/pass unlock) to be available to access company data and (3) de-authorize the device, which immediately deletes ONLY company data. I don't want anything else. I don't want to sync photos, share clipboard, change security settings, send blaring lost-phone alerts. Those are not my problems. Just let me have an isolated VM-like area where I can allow/disallow the user's access to company data.