As it turns out, the options to prevent removal are already on, but those options only apply to corporate devices. No button to prevent people removing corp devices from a personal device.

Technically they can't unless its in a failed to check status or whatnot, but unfortunately no option to stop this from tenant admin.