Good that only you do this, as a whole company setup is complex
Pop_OS is currently not that well maintained afaik, their GNOME desktop is quite outdated.
Just using their OS for the hybrid graphics support is a valid point, but should not be the only one.
Having a well managed OS is crucial, but I disagree that Ubuntu base is the best here.
For stability, a centrally managed Fedora Atomic would be better I think. Way more stable, image-based, all peolple would have exactly what they need.
You could build images locally and take care of the exact updates like that. Or you just share specific configs for each role, like preinstalling different software.
But having things like specific policies, any files, hardening etc. is totally possible during image creation.