Once there's a primary Google account registered on the device and then another work account is added in order to access G Suite of the work place, what are the G Suite administrators are able to access/modify on the phone?
Especially:
Are they able to install apps remotely?
Are they able to intercept communications, by registering private SSL certificates or other means?
Assuming the phone is not rooted.