Hi there!
We are trying to complete the CISO's requirements of reducing possibilities of data leaks. As for our Metabase instance, the main requirement was to disable subscription to all our dashboards, hence confidential data could be sent to any email address. If it is possible to sent just a link to metabase dashboard or disable this feature at all, tell me please!
Disabling Subscriptions and Alerts is a Pro or Enterprise feature: Application permissions
You can also add an allow-list of domains that can receive emails (so users can't send subscriptions to arbitrary emails).