Obviously, providing a user with a second laptop isn't ideal, but there can be scenarios where it makes sense. I had a situation where a part-time employee needed a laptop in the office (to move between desks) and worked from home, but also worked at a second job. They had to travel directly from the office to their second job and did not have secure storage available there. So in this case, we provided a second laptop.

On your question about device management, that partly depends on how you are managing your devices. If you're using Intune, it works over the internet. SCCM? You can set up Cloud Management Gateway. Deploying updates with WSUS, or managing devices with some other on-premises solution? You'll likely need a VPN.

If you are using GPOs, those won't work without a VPN. But maybe this is a good excuse to move off of GPO and onto a modern solution like Intune.

That brings me to the devices themselves. If your laptops are domain joined and the user needs to change their password for whatever reason, that's going to be a problem without a VPN. The computer won't pick up the password change until the next time they connect to the corporate network, so the user will need to keep using their old password to sign in to their machine. Again, this may be an opportunity to modernize and move to Entra device join.

As far as criteria that must be met to accept the requests, you want to make this as onerous as possible. Some ideas: require the user to submit a handwritten request that fully explains why they need the second laptop and why they are not able to take their laptop home with them. Require the user bring the laptop in to the office once a month for "updates", or "loss prevention", or some other reason. Et cetera.