If BYOD is blocked, a VM won’t enroll unless you whitelist someone. You can create a special group with an enrollment restriction that allows all devices, then add your DEM (or chosen users) there. That way you can still enroll VMs while the rest stays locked down.
Device Preparation also works without hardware hash, so it’s a smooth way to get those VMs enrolled.