Completely lock down a laptop

I'm tasked with figuring out a way to completely lockdown a laptop in the event that an employee goes rogue, or the device cannot be recovered. What this should accomplish is preventing any access to the BIOS and removing login capabilities, but the machine should maintain internet connectivity. The laptop will essentially be bricked. Although, this should be reversable in case the laptop can be retrieved. Are there any resources I can look over to learn how to do this. These laptops are registered in Intune and have Azure tenant accounts connected to them. Each device has Windows 10, but the model varies. I'm not too well versed with PowerShell but I'm willing to learn. Are there any books on PowerShell that can point me in the right direction? Any Microsoft learning pathways on Azure/Intune that can point me in the right direction? I have a couple of weeks to figure out a solution, so time isn't of the essence. Any help is greatly appreciated thank you.