If I'm not mistaken there's an option to allow the device to only connect to networks that are provisioned by the MDM. But that would prevent users from connecting to other networks, such as their home network. If that is undesirable, I suggest the password is changed on the "vendor" network instead of attempting hacks on the client devices. If the main challenge is that the network traffic is unfiltered, then I suggest that filtering is done on the client device itself, as devices tend to move between various networks these days. Or that a global proxy is enforced via MDM settings instead to achieve similar results.
