I will spend some more time researching this when I can but I am not getting anywhere with this. Someone here will know I bet ;)
So if I manage our Apple iPhones using InTune, the devices are all enrolled into Apple Business manager, and the apple accounts on each device are federated and they use their work email address. All works great. But we (IT) need to deploy apps to the users for them. It takes a lot of time and effort, but it's great from a control / compliance standpoint.
Quite simply then, can we allow the end user to install any app that is on the app store? And we still roll out specific apps to them? So the best of both really.
We can still block apps after the event, it just allows our staff to download their own apps on the spot, essential when travelling really (car parking apps, booking apps, banking, restaurant payment...