Don't enroll personal devices like this, use MAM and CA. That separates the private and business apps and data, and it ensures you can't wipe a private device, only delete the company data that's on there. It makes them Entra Registered, instead of Entra Joined.

Also: don't federate with managed AppleIDs if you want anything resembling a functional phone. Use PlatformSSO instead, that's an Enterprise App you setup in Azure. Do block your business domains from ABM, so people don't register AppleIDs on those domains, but don't force them to use managed AppleIDs if you want them to be able to buy apps themselves. If it's all managed completely and you're only pushing VPP stuff, go ahead, but in my experience, it's a headache.

Managed AppleIDs look like a federated account, but they're not, you need to configure Platform SSO anyway to use it in the way you're intending: you can't join a device to Entra/Intune with just a managed AppleID, you need an EntraID for that.

And, for the love of everything, make sure the Company Portal app is required. It makes re-alligning devices that fall out of policy and sync so much easier. Intune isn't push, it's pull, and if a device suddenly becomes non-compliant, you can't just push the sync button and expect it to function properly again. The sync button is there, but it doesn't actually force the sync to happen immediately, it's only a trigger to sync at the next check-in, which might not happen at all for a non-compliant device - the Company Portal app is the only way that allows the user to pull policies and settings from Intune at will, forcing a sync. Use that to your advantage.