Unlike Apple iPhone (iOS), Android phone have many variety, unless user buy a Google Pixel series phone or Android One certified phone (It seems that only Nokia still have phone in Android One program and Nokia phone are pure Android OS with similar OS upgrade and security update policy with Google)
It is not easy to recommend a phone for such purpose in the past.
So, Google have a program call "Android Enterprise Recommend (AER)"
Android Enterprise Recommended. It's not just a seal of approval. It's a shortlist of devices and service providers that meet Google's strict enterprise requirements. So you can feel good about setting your business up on mobile. - https://www.android.com/intl/en_uk/enterprise/recommended/ and https://www.android.com/enterprise/recommended/
Search device for AER:
Android Enterprise feature list – which is the feature list for EMM:
For example, Xiaomi have many phone under this program:
For the AER device, each device will receive security updates 90 days, 3 years security update and 2 OS version release upgrade.
BYOD is Bring Your Own Device
CYOD is Choose Your Own Device
COPE is Company Owned/Personally Enabled
COBO is Company Owned/Business Only