If that machine is under MDM (mobile device management) then you should consider even your encrypted disk at risk of prying eyes.

That said, portable apps running off the encrypted disk might also help. Browser, email, etc.