For Apple users our MDMs have BYOD profiles where users can simply enroll with their Google account and it pulls down the necessary profiles to connect, and it's really nice because I don't have any kind of ability to track or erase their phone. It's just enough to give them the wifi and necessary certificates.
Can I do that on the Google/Android side? I feel like I've looked at this before, but the only option was basically full control of the user's phone.
The wifi and certs they need are already in Workspace getting pushed out to their Chromebooks, I just need to get them pushable to the staff too.