You can create rules that would allow devices and such, but, for right now, On-High wants everything quarantined and then manually approved. So specific to your question: "yes"
One option I didn't see in the redhat doc was openvswitch. Don't they support it?
The link I posted was for RHEL 6. I just now saw that RHEL 8's documentation is online. I glanced through it and didn't see that mentioned. I'll read it more closely tomorrow.
There's no mention of openvswitch anywhere in that document. I am aware of XenServer and XCP-ng uses it by default. So its possible RHEL just prefers using macvlan/macvtap instead of openvswitch.
Don't know if we qualify as enterprise, but communities like this help get an external perspective regardless of the size of the organization. The challenge I find in larger orgs is the inertia involved in anything IT. Almost in the literal sense as far as trying to get something started but also in trying to halt / redirect a project that's heading for a bad outcome.
In an actual enterprise, I would suspect that only the management team of IT could have much real impact on a project going a bad direction. And again, it's getting those in management to have buy-in before anything would change.
So how we did it the last place I worked. We used a mix of X2Go, X-11 forwarding/MobaXTerm, and RDP. It depended on the user as to how they wanted to do it.
RDP gave them a full desktop since X2Go couldn't any longer on GNOME 3. X2Go gave them just applications from a menu to pick. People who were used to the cli used X-11 forwarding because it's what they were used to.
