> You can't control it as a network administrator Yes you can. Do what corporate firewalls do. MITM all TLS connections with your own personal CA. Don't allow

> You can't control it as a network administrator Yes you can. Do what corporate firewalls do. MITM all TLS connections with your own personal CA. Don't allow any traffic streams that you can't MITM to leave your network.