As someone who works in IT, it is almost never up to IT what goes onto the Mac device. It's usually a compliance/legal ask, good luck explaining to a customer why you don't have anti-virus.
Customer wants to see: Yes, Company X has Y anti-virus product on all devices.