I believe the fact that it comes up as a “slot” is positive. SATA m.2 connectors don’t show up under slots, they come under "connector"s with type SATA.
The key doesn’t correspond to capability. It’s about the connector’s physical shape. i.e. which side is the lil notch on. B has a notch on the right, M on the left. B & M have a notch on both sides and therefore fits into either connector, but it is limited to PCIex2/SATA speed (i’d guess this won’t matter to you as pciex2 is around 4gbps even on pci1). It also doesn’t mean the length would fit, that’ll be a number like 2230, 2280 etc.
You’d have to check the manual for the motherboard to see if it specifies, but if it’s labelled m.2 PCIe it should work I think. If it only said SATA then it would not work.
You can try dmidecode --type slot on Linux, it should list them as available and presumably specify the type to be PCI express.
I think ultimately you’ll only know when you try, but these may give you some confidence.
I think you’re making a lot of assumptions on how the setup is. It could be fine IF they configured everything correctly and are enforcing things on the work profile. Or, it could be terrible IF they just said “install this app, that’s it”.
Having a company provided device with poor guardrails would at least mean it’s not a device that the staff would do their personal stuff on, installing random apps. Having a company provided device with strong guardrails and fully locked down for this purpose would avoid most of the risk of an undiscovered vulnerability being abused. However well the work profile stuff is now separated in mobile OSs today, there can always be day 0s, and people will install any random apps on their phones or fall for plain social engineering.
Maybe technically right now they’re comparable for security, but their risk profile is different I think.
Imagine just targeting this place for phishing and creating a similar looking app with the same name, then sending fake communication to staff to say there is a new version and install it. They can just install it on their personal profile even if the work one doesn’t allow it and start putting data in it. In the case of a locked down work device they could just not install it. Also, there’s no reason for these devices to leave the grounds whereas personal devices will need to go out into the wild.
Maybe if you consider it a personal device if the staff has to relinquish all control of their entire personal device to the work provided security controls they can achieve a similar risk profile, but at that point it’s just a work device the staff had to pay for, not their personal device.