I had a similar issues this year - a client's admin wanted me to hand over my device for him to setup vpn access. My response was that I'm contractually forbid

I had a similar issues this year - a client's admin wanted me to hand over my device for him to setup vpn access. My response was that I'm contractually forbidden to allow that since on my device there's data GDPR-relevant and otherwise of other customers. You can also make up a company-policy (even if you're a single person) and communicate it that way. "There's a strict company policy preventing me/us from installing this kind of software." Apart from that, this violates the no-asshole-rule.