You should not perform an enterprise wipe through AirWatch on an enrolled DEP device. Instead, perform a device wipe, so the user is forced to re-enroll when it is reactivated. To discourage an enterprise wipe on DEP devices, AirWatch displays an additional warning in the AirWatch Console when performing the command.
Additionally, AirWatch recommends restricting the Self-Service Portal (SSP) role for end users from using the device wipe command. You can configure these roles by navigating to Accounts > Users > Roles.