I get this as being a bit of a hurdle, but wouldn’t a good option in hind sight be to create a separate work related apple account based on your work email? I’ve done that in the past with various companies for iPhones and MacBooks. Makes it cleaner to return the device and doesn’t compromise my personal account should they ultimately need my credentials on the non-owned-by-me device.
Just read a review on Amazon today about a newer brother printer that they’ve instituted a lock out on toner. Was telling a colleague that they were decent enough to not do that… But then I ate my words