Best approach i think is, they way "ungoogled-chromium" does it. They don't enforce organization policies, but they set the default config to "no search" and then leave it up to the user to change it.
Perhaps a ballot on first run, much like browsers should be in a well regulated market.
It worked great for cookies in the EU. Really improved my browsing experience.