Is it possible to fully separate corporate from private contact data on a BYOD? I did some research on the various ways how corporate data can be protected on a user owned device (BYOD) running iOS.

My understanding is that, through mobile device management (MDM), I could create networking and usage restrictions for certain apps specifically. For example, I could require the user to be connected through a specific VPN in order to use app "X". 

I also understand that data is separated logically in the way that, for example, the contact data retrieved from an Exchange Server is only available as long as the configuration setting for said server is active on the device. Deleting it also removes the contacts from the device. 

What I cannot figure out is if there is a possibility to limit the scope of the contact data provided by such a corporate server without resorting to third party apps that containerize the data entirely. I'll try to make this clearer with an example. 

On my private iPhone, I can allow apps such as WhatsApp or facebook to access my contacts. I am using multiple cloud accounts that sync contacts to my device but on my private device without any mdm, I am not able to restrict this setting to just one specific cloud account - if I understand correctly, "contacts" just means any contact the device has access to.  

As the corporate administrator of an mdm solution, would it be possible for me to restrict this, i.e. prevent the user from giving access to company owned contact data to third party apps while not restricting him if he does so with the contact data held locally or coming from a private server?
I spoke to the representative of a well known MDM solution for iOS today about this topic. He confirmed to me that iOS does not support such a separation of work and private data. In other words, you cannot restrict apps to access only specific contact accounts, it's all or nothing. MDM solutions usually deal with this by offering their own containers (apps) for mail and contact management.