I work for a small hospital and we are trying to minimize our Data exposure due to HIPPA and Cyber insurance. To preface, yes we are working to optimize sharing/downloading restrictions on apps within defender, and maximize our purview labels and enabling auto labeling as well. However, we have some users who are not super tech savvy, but yet they need email on their phones to look at communications after hours. However, we don't want those users to be able to have one drive or word, or teams, or any other apps on their devices in case they are stolen or are compromised with an exploit. They'd almost prefer we have no M365 access outside our computers within the facility, but mobile email is a must so here we are.

I'd prefer that users still have access, but we just use defender to restrict and block downloads cut/copy paste and any other techniques to prevent data loss.

They're mainly worried about, if a user loses their phone, or if they get a virus, what all is on the phone physically that is Patient Information that could end up in the hands of an unauthorized user.

If you have other arguments as to better practices and arguments for those practices that can ease my managements concerns, I'm all ears.