The solution: Apply default lockdown rules to new workspaces
Using SProbot's Teams and SharePoint governance rules, you can automatically set the sharing settings on newly created workspaces to a restricted state.
You can choose to either just change who within the group can share, or set a hard-lockdown on external sharing which cannot be bypassed by group owners.
Learn about governance with provisioning pipelines