Q: What is best way to use a corp apple ID for icloud and let users use their Apple ID in itunes store?

What is the best setup for us to maintain ownership of our corp issued iPhones and iPads yet allow users their personal apps from their iTunes accounts? I have gone out and created a corp apple ID that we are using in the iCloud setup on all our corp owned devices. This keeps the end user from using their apple ID in iCloud and hence when employee's are unexpectedly discharged we still maintain ownership and don't have to ask them for their Apple ID & password when resetting the devices. It also does not allow them to do backups to the cloud or locally either way. We are very careful to turn EVERY thing off inside the iCloud set up area. Even turning off iMessage and share my location. We do keep the find my iphone or ipad on however. So how can I lock these settings to keep users from changing them? Or is there a better way to manage corp devices without having to buy into anything to manage them, we are a non profit.