Reduce the number of passwords the user needs via SSO.

Be absolutely strict on password sharing via non approved means.

Bitwarden enterprise for whatever is left, with collections per team/department.