Unless I'm missing something, this is not possible (unless you install a certificate root supplied by your employer) because any man-in-the-image attempt would be flagged as a failed certificate authentication. Indeed, that's exactly why certificate chains tied to domain names exist.
They can however look at your DNS queries, and even if you use encrypted DNS they can still inspect the certificates of sites you are going to to figure out what the domain is.
In the past it was possible to quickly swap the physical sata hard disk on some laptops to segregate work/personal use, but that's no longer viable with modern laptops.
On the plus side carrying 2 modern laptops weighs the same as one oldshool laptop and they use the same usb-c charger...
Be careful with this. My MacBook Air will charge off anything, including a 5V battery bank. My Dell won’t charge off anything less than 18V over USB-C.
Got caught in a bind once when I brought my “slow” charger thinking that would be fine for light use on a trip away. It was not.
Many of these corporate inspection tools seem to leave traffic on nonstandard ports alone by the way, just saying ;)
Of course they’d lose their ability to issue public certificates if it became widely known, but they have it within their power.