Use a different account for cloud services (which most companies would already do) and use two factor auth. Easy breezy.