I have about 20 staff with their own iOS devices (as in, not issued by the company). Some users need apps like 1Password, while others need to test in-app purchases (not in-house titles, so no sandbox). What's the best way to provide these guys access to these apps in such a way that if they leave, I can remove access for company-based purchases?