AAD joined and Hybrid Azure joined

Hi,

we have some new Windows 11 devices (Surfaces) that when joining to local AD, seem to create an AAD joined device in Azure and a Hybrid Azure joined one.  Our non Surface devices display as Hybrid Joined.

We want to only have the Hybrid joined devices as currently this is messing up our Configuration profile settings etc.  Are we doing something wrong when building these machines?