If setup sensibly they will ONLY connect via VPN to a VPN server on BA's own network. I.e. the iPads will only operate online as if they are within the corporate network. The iPads will be managed thoroughly through management tools run by the IT support team. The users will only be able to use the iPad for the specific tasks it is intended for, and will be unable to change the configuration of the iPads themselves.