My company recently adopted SecureMail, SecureHub and the other Citrix mobile stuff, it seems to sandbox itself from the rest of the system pretty well. It controls which apps you can cut-n-paste between or share links to for example. I think it's uses MDM under the hood to manage data sharing and permissions.