With an Android enterprise work profile you can:

A work profile creates a separate, encrypted container on an Android device, isolating work apps and data from personal apps and data. This allows IT administrators to manage only the work profile, ensuring work data security without accessing personal information. The "Work Only" aspect refers to the profile's scope, not the entire device. The other options are incorrect because a work profile does not grant IT full access to a personal device, nor does it fully protect all data on the device (only work data). It also doesn't create a "Work Only" profile that manages all data on the device; it specifically separates work data.