how do you handle the need to update employees daily without manually having to import or remove records?
The way to update Marketo people based on an external service (such as your internal HR directory, which I assume is Active Directory or comparable LDAP server) is to have an integration piece that reads from your LDAP and then writes results into Marketo via the Marketo API.
It's not exactly difficult, but it's not built-in. Presumably if Email (O)pen is communicating with your internal HR server, then your IT already trusts the inbound connection to the LDAP (it's probably locked down by source IP and is read-only). You have to extend the same permissions to a Marketo layer.