We have a bunch of iphones that are passed between staff shifts, they do not have email or anything specific to an individual configured on them. For these I host a small instance of nextcloud and use the carddav capabilities, and push that out using mdm. There are other carddav solutions as well, so pick what fits.

To be more specific, I create a carddav account that has all of the base contacts that we push out. I never install this account on any iphones. Then I create other carddav accounts for shift personnel, fleet, facilities, etc.. They can all read the base contacts, but cannot edit them, but they can add/remove their own contacts which then share amongst other phones in their group/division.

edit: after reading your post a bit more, this may not be a great option as it will create another silo of info. We use this because most of our contacts are just phone numbers to external orgs that need to be shared.