In case anyone else finds this via search before this page - there is
currently a "2" option that forces incognito for the setting: defaults
write com.google.chrome IncognitoModeAvailability -integer 2
https://cloud.google.com/docs/chrome-enterprise/...