I think our friend Karl had a LOT of wisdom that is somewhat applicable to the questions you’re asking over in this thread. In an era where “staff resources” should be becoming more and more accessible from anywhere I think it’s a great time to revisit some of those things. Enabling staff and key volunteers to work efficiently from any device has its value. Your team can spend their time managing access to the tools and securing the data vs the computers.
More to your point, we’ve had a few situations lately where we have made cloud-only accounts in M365 for mail and other services versus an AD account that is synced up. Limit your scopes appropriately where you can.
Otherwise, I think you’re on the right track.