The most effective way to manage extensions in this scenario is to use a combination of OUs and groups.
Create an OU for the shared devices and force-install the shared extensions at this OU level. Then, create separate user groups for FTEs and Contractors in the Google Admin console and force-install their specific extensions to these groups. User group policies have a higher precedence than OU policies, ensuring the correct extensions are available to each user type when they sign in to the shared devices. Option A mentions Group Policy Objects, which are for Windows environments and less relevant in a cloud-managed scenario across potentially different OSes. Option B doesn't address the shared device aspect effectively. Option C is not a managed approach.

The "Chrome Browser -> Reports -> Apps & extensions usage" section in the Google Admin console provides detailed information about installed extensions, including permissions and a risk assessment (if available through integrated security features). This report allows administrators to filter and analyze extensions based on their risk score and the number of permissions they request, enabling them to identify extensions that meet the cyber risk team's criteria.