I thought this might be of interest to the community.
We are now using a smart device group to capture devices that are "out of order" in some way (jailbroken, location services off, too old version of iOS) and effectively shut them down until an admin intervenes.
To do this, we scope a profile to this group that uses a Restrictions payload to block all apps except Self Service ("Only allow certain apps"). We also use a Home Screen Layout payload to put SS right into the dock. This way, if a device falls out of good order, there will have to be some - ah - re-education of the user before work can go on.
I usually give a grace period before updating the smart group criteria to the very latest version of iOS. It occurs to me writing this that you could also use the iOS version comparators in JSS 9.93 to detect and shut down people who have installed iOS 10 betas, if you needed to.
I have a more detailed discussion on my blog: "A Lockout Protocol for iOS 9.3".
Cheers.
