Somewhat roundabout, but WEI can make it so you need to have an allowed device-OS-browser combo for important services like banking. The device can then make it impossible to install another OS, and the OS can make it impossible to install another browser. Then the browser (or the OS) just receives blacklists (and possibly eventually whitelists after everything is entirely corporate captured) from Google/Microsoft/Apple.