When installing OpenSSH Server, it prompts you to enter a new root password, and since it's installing as root, it can change the already set password.

And if your workers are aware that they are tracked, and that it's a requirement for their job, trying to prevent that should result in them loosing their jobs. If they are not aware, you'd better hope they don't find out or they can sue you for hefty amount of money and jail time for nonconsensual privacy invading.