Currently the Android for Work policy for user adding accounts is an all or nothing.
There are many use cases where corporate email in the android work profile should be managed, while other work apps should also be allowed to add accounts by the user, but not all.

Many android apps are cloud connected, but not required which most admins won't want users to login to due to ability to bypass data controls, while others you cannot use the app without logging in.