How not to block your Mac?

Question

macOS

We buy apple devices (imac, macbook) for employees, including those who are only hired (they are not yet trusted). There is a fear that if there is a disagreement with someone, he may block the mac through icloud, or simply it will not be possible to reinstall macos without his appleid.
Question: what should be done in advance to avoid any problems? I don’t want to somehow limit the user, i.e. an administrator account, the ability to link your apple id, etc. - everything should be.
Is this option possible: a corporate apple id is created and the corresponding administrator accounts on computers, a new administrator account is created for the employee, will he already link his icloud there? Is the scheme working? Will he be able to block the mac like that? Will we be able to unlock/reinstall later? What happens if he (the administrator) removes a corporate leak on his computer?
What else can go wrong when passing a mac from hand to hand?

Answer 1

How is blocking icloud different from the fact that such an employee simply drops the device "accidentally"? As an option: make mail for each device, bind and not give access to mail, but give a bunch of mail + password from icloud

Answer 2

Is it possible to block MacOS in a brick? It's not iOS.
From a flash drive / over the network, you can always restore to a clean system.

Answer 3

In this case, create separate iCloud accounts + there is an official Apple Remote Desktop application in the App Store. Mac computers can be controlled there