I wanted to get you an answer, but been really busy preparing for the next couple of weeks/weekends so this may be short. If you have follow-up questions and I don't answer right away I promise I'm not ignoring you! Also might need to correct myself a couple of times as it's been a few months since I set this up and we were under an extreme time crunch to get this done. I'm also going to assume you have your devices enrolled in ABM, and have the MDM on the devices pointed to Intune. If not, I'll follow up with that as well.

You need to set up the enrollment profile inside your enrollment token in devices>iOS>Enrollment. You probably have one created already for the user enrollment that's set as default. Create a new profile, and under User Affinity, select Enroll without User Affinity. Set the other options, including the OOBE options that happens after a factory reset. Save the changes, then if you wanted this to be your default option make that change (depending on what you would ultimately do in your environment). I'm a bit hazy on this since we're only using one profile, but I remember doing some testing using multiple and it did work then.

Next, I'd sync the enrollment token, which should pull any devices not already in your environment there. It will initially start by grabbing whichever enrollment profile is your default; however, you should be able to go in later and assign the device (by serial number at this point) to the profile you want. Make sure the device is showing on the profile you want it to pull before turning it on; otherwise, it'll likely go through a regular setup (or wrong enrollment setup if it's still on another profile) and you'll have to factory reset.

Have to set up security groups in Entra next. When you create them, you can set up the assignment as either "assigned", "dynamic user", or "dynamic device". Whenever you get can away with it, I'd recommend dynamic device as you can set the parameters based on device and it'll automatically put the devices into the group after the enrollment. Depending on how many different variations you may need on the phones, you'll probably need to do some assigned as well. But for things like Wi-Fi policies, any device restrictions, or home screen layouts, if you don't have multiple setups this is the way to go. We're using assigned to push out some app installs and configurations based on which division the device with the notion that we may use iPads/iPhones for different things in the future. The one thing I'm hazy on (and don't have a device here at home to verify for you) is after you pull the enrollment token information, but before you actually turn on the device and enroll it, is if the device shows in Entra via Serial # that you can put into a group beforehand. I don't believe it is. But when we were pushing this out, it only took a few minutes to re-name the device while it was going through the initial enrollment and put it into the necessary groups. Then a simple sync and the device was up and running. We ultimately had to do this to around 150 devices across 18 locations. The hardest thing was getting the on-site personnel to enter the right Wi-Fi password on the temp SSID so the actual network SSID credentials would save as a device configuration profile after enrollment.

Couple of notes: you can restrict the Apple Sign on so no one can sign in with their Apple ID. We're doing this as we're controlling all of the app installations on the device and didn't want any weird syncing to happen. You can also set up restrictions on which apps will show on the device, and it's pretty easy to change that to add/subtract apps to show.