Our company is facing a problem that employees can download files from their personal devices. Some of our public sites contain sensitive information and CISO wants to implement them as read-only and not downloadable.
Other requirements are:
We cannot encrypt the pdf, because employees should be able to download it internally.
We cannot install agents on their personal devices like phones or laptops.
Any solution or product solution is appreciated. Thank you very much.
It would be easy to restrict access from personal devices with Conditional Access policies using Azure AD (but not restrict only the download). There is a plugin (extra license costs) for advanced SPO management (MS Syntex) to disallow downloads.
But since you are on-premises, your only option might be to apply the permission "restricted view" to the users you described.