Full-time Workspace admin here. My company currently doesn’t manage devices or use work profiles either. I can’t see anything on a user’s device, the most I can do is block the device from syncing or wipe the data owned by the work account (but not touch your personal apps or files). The admin documentation is actually public at support.google.com/a/.

If data is needed it’s going to be on request from the security, compliance, or legal teams. Your particular use case is pretty low risk. By default the Gmail app caches the last 30 days of email, but those are stored within your work account on the cloud anyway. So I could get what they need regardless of your device. There would be more risk if you were downloading local copies of Google Docs or something.

To lower the risk further you could make a totally separate user on Android (with its own PIN, homescreen, apps, etc). The OS should partition that off and encrypt it so it can’t even interact with your personal data. However you’d have to switch logins if you want to access personal stuff. I haven’t tried the other sandboxing software mentioned here so I can’t vouch for it, but that could be a lot more convenient.

Of course for zero risk of your phone being confiscated in a litigation sweep, it’s best to just have a totally separate work device. That’s what I do.