At least dual-boot a second OS that they have no control over.
I highly doubt that a company will like that you dual boot their machines.
How would they ever know?
well if they don't manage it via some kind of MDM software, that would mean the employee is responsible for security on his own - at which point he might as well use his private laptop for work stuff.
The BIOS/firmware would have to be locked down and disallow USB/etc. booting, I don't think that's normally covered by MDM? Does UEFI even expose an ability to control that via software?