Our advice (see our input on many virus discussions).

Our organization doesn't accept any PC without an actual virus scanner
on the network.
When we hired personal they had to confirm f.e. our virus and security
policies. Mostly such persons have an additional PC with network
connection. During their project they are a "member" of our company
and they also use our company-wide license of such software.
Another reason we give them another PC is: their organization can't
blame our organization for infecting their organization with a virus.
Greetings.

btw: another element you can use are the IP numbers. For roaming users
we have reserved a specific range of IP numbers and by a logging on
session those machine will be checked for the actual configuration
(f.e. is virus activated and has it an actual update).