Should I let people experiment or give them strict rules?

Both, with a lean toward experimentation inside safe boundaries. Give people a clear "you can do this, don't do that" framework, then let them explore within it. The teams that get the most value from Cowork are the ones where individuals find their own uses for it. You can't predict every good use case from the top down.