Re: priv withould gold emm=no MDS and company email must be open to the web?
My understanding ist that for a PRIV to work via the BES secure tunnel you need either the Secure Workspace (SWS) app on the phone or you need Android for Work.
To achieve this you can use the following activation types (BES 12.4):
Work and personal - user privacy (Android for Work)
Work and personal - user privacy (Android for Work - Premium)
Work space only (Android for Work - Premium)
Work and personal - user privacy (Secure Work Space)
Work and personal - full control (Secure Work Space)
For the 2 SWS options you need Gold. For Android for Work, Silver would be fine (just no Secure Connect Plus).
I have not tested this, so I cannot guarantee that Silver will work.
I don't know about KNOX, it might work there as well.