Looking into managing WFH user's wireless with a UniFi USG. Is what I'm wanting to do possible?

Hello!

I am looking into giving a few of our users who are always work from home a USG paired with a UniFi AP so that we can make sure the router they're connecting to us with is secure.

I'd be setting up an IPSEC tunnel to our network.

Here's the kicker: only company issued devices. So only their laptop would be able to connect.

So- the idea would be that we would have the USG give them two separate networks so that their can have a company wireless and a home wireless that use one AP, but are separate SSIDs and can't talk to each other.

Is what I'm thinking doable or am I going to need more that just the USG + UAP?

Thanks! :)