One of the goals we have with the research papers is to save other companies time and effort in moving to a BeyondCorp model, especially because as we've grown the model internally we've opened up many of the elements to others to use. On Google Cloud this is collected under the umbrella of Context-Aware Access.
The best way to stop malware is binary authorization, allowing only trusted, safe executables on each managed device. Every system gets tricked, even this one, but it's by far the most reliable way to protect yourself, especially from zero-day vulnerabilities.
In "Building a Healthy Fleet" we dig into ways to manage a fleet of machines, including monitoring and maintaining their health. That paper links to a bunch of tools, and lays out best practices across many methods.
OS Query and Santa are two open source tools to help with controlling what software is allowed to run on machines you manage. They give you both control and visibility, and can scale to a large number of machines.
Google also provides Endpoint Verification for Chrome and Chrome OS, allowing you to then feed machine metadata directly into access decisions made by other BeyondCorp tools to control which devices can access Google Cloud resources or Cloud-backed web-apps.
I don't think any of the tools I've listed will prevent data leakage from individual devices, but you can see other discussions here.