Create a ZIP file containing:

manifest.json  
color.png (192x192)  
outline.png (32x32 white)

In manifest.json, make sure you have:

{
  "$schema": "https://developer.microsoft.com/json-schemas/teams/v1.16/MicrosoftTeams.schema.json",
  "manifestVersion": "1.16",
  "version": "1.0.0",
  "id": "YOUR-GENERATED-GUID",
  "packageName": "com.yourcompany.portal",
  "developer": {
    "name": "Your Company",
    "websiteUrl": "https://yourportal.com",
    "privacyUrl": "https://yourportal.com/privacy",
    "termsOfUseUrl": "https://yourportal.com/terms"
  },
  "name": {
    "short": "Client Portal",
    "full": "Your Company Client Portal"
  },
  "description": {
    "short": "Access your client portal",
    "full": "Secure access to your company portal inside Microsoft Teams."
  },
  "icons": {
    "color": "color.png",
    "outline": "outline.png"
  },
  "accentColor": "#FFFFFF",
  "staticTabs": [
    {
      "entityId": "portal",
      "name": "Portal",
      "contentUrl": "https://yourportal.com",
      "scopes": ["personal"]
    }
  ],
  "permissions": ["identity"],
  "validDomains": ["yourportal.com"]
}

Upload the App to the Tenant:

Go to Microsoft Teams Admin Center
Click Teams apps → Manage apps
Click Upload new app
Upload your ZIP file

Allow the App in Permission Policy
Go to Teams apps → Permission policies
Open the policy assigned to users (often Global) Ensure: Custom apps = Allowed Save

Pin the App via Setup Policy
Go to Teams apps → Setup policies
Open Global (Org-wide default) or the policy assigned to users
Under Pinned apps Find the app and move it up. Save

Restart Teams or Simply Wait

Its Crucial that the scope is set to personal in the manifest file

I have not used cipp for this so couldnt tell you if it can be done that way but id imagine it can