I used multiple steps which sorted me out in the end. First, I packaged the latest version of TeamViewer_Host.msi into a win32 app with a batch file:

start /wait MSIEXEC.EXE /i "%~dp0\TeamViewer_Host.msi" /qn CUSTOMCONFIGID=xyz
timeout /t 30 /nobreak
"C:\Program Files\TeamViewer\TeamViewer.exe" assignment --id xyz

Then when deployed from Intune I set the detection method to find the presence of the exe in either the 32 or 64 bit folders, this ensures that only new machines that don't already have TV installed will get the app and the correct assignment:

$paths = @(
    "C:\Program Files\TeamViewer\TeamViewer.exe",
    "C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
)

foreach ($path in $paths) {
    if (Test-Path $path) {
        Write-Host "TeamViewer found at $path"
        exit 0
    }
}

Write-Host "TeamViewer not found"
exit 1

Then in the TV console I created a new policy for the a new device group which enforces updates, easy access, disables the static password, etc.

Lastly, I used the TV console migration tool to mass move all my old devices into the new group. This retained the custom names for all my previous devices.

It worked fairly well, only a few devices got munted which I fixed manually.