How to secure a device you don't own, but the CEO insists on using?

So interesting problem. I've discovered that our CEO like to use their own device that they recently purchased and had a family member "secure". They are using it, while travelling abroad. This scares the bejesus out of me for obvious reasons.

I do not currently have a strict MDM policy, but after this, I'm considering it. How would you go about wrapping their O365 (E5) account to greater security, just to make sure its extra... secure? :D

Obviously I can't block them with conditional access, or they'll know, since its been working until now (and I really don't want to block them, but I do want to secure the situation a little better).

Edit: So, after reading through this, I'm definitely deploying MAM policies, and I've spoken with the GM, and we are going to get a policy written, which will essentially put the onus on any staff member who decides to use a personal device for accessing work content, will be willing to absorb the cost of a breach should it be determined to stem from their device use. This will pretty much put the onus on them to either follow the rules, or else $$$.

I appreciate the input from everybody btw. This group is definitely one of the better ones here on Reddit.