Sophos Secure Workspace - Best Pratices?

Hello everybody,

I’ve got some questions about Sophos Secure Workspace and Secure E-Mail for Android.  

Currently i am using SMC as MDM solution by prohibiting installations of all apps and using the pre-installed E-Mail app.

But times change and my users wants to use Apps which i don’t want to allow them on the same surface on where my company data is stored.

Therefore i built a Sophos Container-Policy for Android to test how a „Secure“ Workspace is possible to handle.

After testing a few possible scenarios and policies I’m wondering how i can prevent Data from entering the Secure Workspace or from leaving the Secure Workspace.

How can that Container be safe if every kind of file is possible to enter or to leave my Container when the user wants to.

I tried to deactivate the local storage in the policy but in effect the users cant safe any file which they received via email. A Sandbox-Storage implemented in Secure Workspace-App would be great.

Although i can sent every file via Secure E-Mail from local Storage.

So what exactly is the advantage of using Secure Workspace an Secure E-Mail Apps comparing to Apps that are integrated in Android. Is that solution only fully usable with Sophos SafeGuard and/or with activated Cloud storage?

How is everybody else dealing with this?

I would be glad if anyone could give me a hint.

Best regards