What do you mean by work tagged?
If you are deploying iOS apps via VPP in ABM, you already have management of the apps. iOS native apps you can hide or unhide what you want via restrictions.
Apologies this should've been explained better.
Our thought on this was that through managed applications we could prevent iOS users from sharing data to unmanaged apps. Kinda like on Android and how you can have multiple instances of apps e.g. you can have two Google Drive. One that is managed for work and the other private for the user.
We still haven't been able to properly achieve this for iOS. It seems as a restriction profile is our only option. Although our profile should prevent users from sharing data, they can still take a screenshot from a document and save it to Files or their gallery.
Perhaps ABM could help us. Not sure though as we haven't tried it yet.