Recent enough Androids have this "Work Profile" feature. You get two app stores, and work apps get little "work" overlay. There are separate lock settings and sound/notification settings for work profiles too - I think this means you can have simple pincode for personal stuff and more complex for work one. And you can turn off all work apps at once with a single button press. And if your admin gives "remote wipe" command, only work apps are wiped.

Sadly this is automatic, which means regular people can't use it. You workspace admin got to enable MDM, and then phone will prompt you if you want a work profile when you try to install it.