They seem to want to keep work segmented from personal. Why not just use a separate Mac user account that isn't connected to his personal icloud account?
Again, the whole work vs. personal networks isn't what's really relevant here - it's the auto-joining of synced in Wifi network(s) from other devices that's the real issue (see my other post(s) here for an example).