it depends. If they need tcc or kernel extension they definitely must have an MDM, and simplemdm is a good and cheap one for this use case