You can use Workplace Join in Server 2012 R2 to allow user’s non-domain joined devices to participate in the domain in so far as security (allows multifactor authentication) and be registered as devices in the domain. While you still couldn’t apply GPOs to such devices, you can allow access to domain resources with the ability to selectively get to corp. data and wipe it if lost or stolen. This applies to iPhones and iPads as well as non-domain joined Microsoft platforms.
I think this is a good move because just saying “No, you can’t use that phone to access corp. data.” to a VP or big boss is political suicide. Of course you’re still in trouble if data gets compromised, but this allows you to control it while allowing workers to use their consumer devices without making them part of IT.
That's excellent news and advice, thank you! I will be making use of your information very soon, I wager. As you say, we would all like to avoid political suicide. :)