this is the best route, and really a security policy that should be implemented anyway. its one thing giving people access to the cloud, but a full copy of the entire database on their PC is a recipe for disaster even for a team member that you aren't firing.

what if the laptop got stolen? what if it is a node on a botnet?

this is a really good call and even if you don't take this approach, I'd definitely have HR initiate this.