This is the correct answer. If they want you to do any work in a mobile, remote, out of hours capacity, they need to provide the device.
I used to help manage MDM at my old company and I can tell you there is a shit load they can do once you install their utilities. For example:
- remotely wipe your phone
- block your ability to copy/paste between applications
- view all web traffic to/from it (even encrypted traffic since we installed a proxy that put its own trusted root certificate in)