[kccqzy]

Sure you can create a separate account on your company Mac. But there's no assurance that whatever work resources needed would be available on that second separate account.

If your work is on the traditional model of perimeter protection and trusted intranet, a non-work device can't join the network as you have correctly pointed out. If your work is on the newer BeyondCorp style model, switching to a second account on your computer is going to invalidate the device trust needed to access work resources.