A solution like Windows Intune can be used to create application control profiles. When the user installs the software and signs in using their corporate account, the Mobile Application Management (MAM) policy can enforce specific restrictions to ensure the application is used safely (such as enforcing a pin or local disk encryption). If the device is not compliant, the application cannot be used and any company data can be removed without impacting other applications and data on the device. All of this is possible without domain join or MDM enrollment.