@wirestyle22 said:
I'm wondering what kind of settings I should realistically set as best practices for this sort of thing. Any ideas?
Will the devices travel or live at the office? If they should never leave the site, setup geo fencing.
Lock down installing apps, changing settings, various things.
Setup a list of apps to auto install, enrol in Apple's enterprise app management so you can do it nicely.
There is a warning if jail broken or other things happen.
You can enforce passcodes
Disable Siri, disab camera, allow gaming, fair few settings.
Depends what you want. It's fairly decent.