Employer provided and managed hardware is treated as a hostile entity on my network. Separate SSID, separate VLAN, no access to local resources whatsoever. I don't even let them talk to my local DNS server, they reach out to Google and/or Cloudflare.

Further, I don't put any personal accounts on employer provided hardware. For example, I always use a dedicated GitHub account for work stuff and the key and password never leave that machine. This ensures a clean break when I'm no longer at that employer.