Can personal profiles be removed on work devices? We're looking at rolling out 100+ android devices and would like to lock them down to managed profiles. This is mainly to prevent excessive data usage (youtube and the like) - Android for work allows us to whitelist apps, set policy etc; but this is in addition to the standard user account.

This is cost sensitive, so is there a solution out there that will allow us to lock the phone down to only the managed work profile so that additional applications cannot be installed?
You could use apps like AppLock and lock the Play store: this way, without a password set by you the user shouldn't be able to install anything. I don't know if there are better solutions, maybe already implemented in android for work; and I don't know, more important, if this has any drawback on app updates. But worth a try, if you have no other ideas.