MDM can restrict pasteboard from managed apps to non-managed apps, as well as allowing iCloud sign-ins but restricting which iCloud services are allowed.

It's an absolute failure of the MDM server administrator for allowing such things, not on Apple.