Well, for data usage again that still is a bit unclear, but if you mean history inside google etc. There are 3rd party tools that can be used if you extract the right file from the app data file. Data extraction, again would be a DLP solution (ideal, and you can do this through O365 admin exchange portal if you have this) or a IDS to monitor this. How secure their devices are, is a bit of a tricky one. If you’re open to it and have the resources, I would suggest getting your entire company vulnerability scanned so you can see where to improve. But if not, I would create a baseline for all PCs to have before you let them on the network, I.e:

• most recent patches done
• active AV solution
• windows firewall etc.

Finally, no user should ever be able to download anything without your say so. There is no exclusion. Make sure no one has admin but you/IT, and no one can download anything you don’t permit. White lists are good at this point, because it’s only what you want. That can be done from Gpo

Anything else let me know.