The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation.
Employees depend on an open internet for research purposes (adblockers are a no-no), however, I can't allow the possibility of browser-spread malware within the organizational network. Employees must be able to use either their own device or their office workstations and browse the internet freely via our network.
What kind of solution would work best here to isolate the act of browsing from my internal network? browsing via VMs? sandboxing? containers? Has anyone had any experience with implementing such a solution?