I use a S23 Ultra and have my work profile on a sandbox environment with Knox, I can also turn it off at the end of the day and while normally work could have access to my personal data, knox blocks that.

Don't.

Two reasons:

Many employers require you to install phone-management software as part of the data loss mitigation/data exfiltration requirements - and those requirements might be set by their insurers.

This gives them the ability to remotely lock or wipe your phone at any time - useful to them because they remove company data if you lose your phone, or you leave the company, or are suspended for any reason. Obviously that'll also lose any personal data on the phone, but that's your problem, not theirs. They can also monitor its location and similar things.

That's obviously a reason why you should never, ever, use a work-issued device for personal use - besides it being against their acceptable use policy. If your employer requires you to check email then they are required to issue you the means to do so. They cannot insist that you use any personal devices for that.

It's bad for your mental health.

Keep work to work hours. Keep work devices for work. Keep personal hours and devices for your personal use.

This physical separation requires a little discipline but, having been on all sides of this barrier (employer, employee, suffering with poor mental health, and currently, in good mental health) - I know this to be the only way to achieve a health balance.

I would never mix private data with work related data. You should get a second phone for work related things. As pointed out by others, it may be technically possible to have both on the phone without interfering with each other (which also would be more convenient), but keeping things separated physically has another advantage: Data you are handling/ generating at work belongs to your employer. This means that he can demand (problbly backed up by law) to search your phone when things should go south in the future. You don't want your employer to have a peek at your personal phone, do you? Also, your employer might want you to install tracking/ logging software to make sure you really do the work. By having a dedicated phone for work related stuff your private stuff is out of focus.

Main issue is that you have your work e-mail on your pocket, and can see them 24/7

Please don't be a hero. Work your 40 hours and then stop. You didn't clarify, but I'm slightly worried that you want to be more connected which might lead you to increase your workload or working hours, and that will make your job less sustainable in the long run, and we really want people like you to stick around for many years to come.

I've managed Duo installations. The administrator can see your phone number, your device os and version, history of authentication attempts.

People have already answered well enough though many of them mention IP addresses and you said you were non techy so wanted to add this

Giving away your IP address is not that big a deal, you do it every time you visit a website without a VPN or connect to pretty much any web service

(You still shouldn't post it publicly of course but it's unlikely your employer is going to dox you, and if they do it's probably illegal)

Duo is Cisco's version of authentication. The only permissions it has on my phone is notifications.

In its current form, it doesn't appear to let your company's IT department control your phone.

If it's Android, set up a work profile and put the VPN and email on that.

If you have an android phone you can make a work and home profile so the two sessions are totally separate. It does mean swapping back ans forth between profiles.

Ask for a physical device like a yubikey instead of the duo app.

Use the web browser to access email.

+1 to being out of contact – It can honestly wait until the next time you’re near a work computer. (I’m hoping a work laptop or something is involved here.)