Can you not have the employees join the domain, like how some companies let you enroll in Exchange on a personal phone in exchange for allowing device administration/remote wipe?

As with a phone, if it bothers the employees (it'd certainly bother me) have them buy a laptop for work only.