Prevent users from making copies of SharePoint/OneDrive data that was downloaded via sync app

We have a client who is planning to roll out OneDrive for Business and SharePoint. The goal is to allow users to synchronize [SharePoint/OneDrive] libraries on their laptops, using the sync app.

We already put in place policies to prevent users from syncing from non-domain-joined computers, and their hard drives are also encrypted (in case a laptop is stolen). We know you can limit actions on data in the portal, such as copying, forwarding, saving-as, downloading, etc.

The main concern, however, is how do we prevent users from making copies of the files that will reside in their laptops once the libraries have been synced on their laptops.

The focus of this post is not on an outside attacker, but rather on the employee itself. For instance, a user may not necessarily need to get fired to be disgruntled and make copies of the data before departing, s/he may make a copy of the data anytime prior to the termination. How do we prevent this? or is it even possible?