I believe blocking it is an option. Can't do developer mode if you're enrolled and they can force enrollment on a device so if you try to wipe it and access developer mode it refuses and forces you back to enrollment.