If users are also allowed to use their private Android devices for business, you can assign them apps from the Google Play Store or your own (self-hosted) apps. All apps that were assigned to the user under Administration→ Apps are automatically part of the work profile.
You can recognize the apps by the briefcase in the app icon (left illus.). In the work profile, business files cannot be moved into private apps (example in right illus.). Under Open in, the user will only be offered apps that are part of the work profile. Thus, private and business data are kept apart from each other.