The one app that flies in the face of all this logic, e.g. when to have it in the blocking list and when to have it set to Required, is the SCCM Client, during Hybrid Join mode with Co-Management enabled. If the SCCM client is in the Blocking List and it installs successfully and Configuration Manager becomes active then it will become the management authority and it will cause the provisioning process to fail. The Intune Management Extension no longer has authority and cannot proceed.
My challenge, which I have not yet resolved, is how to have the SCCM client install reasonably quickly (e.g. within an hour) after the provisioning process has completed. I have it set to Required Intent and NOT in the ESP list of apps to wait for, and it does EVENTUALLY install, but often not for hours or until the next day. We have a whole bunch of work we need the SCCM client to do for us to get the device to where we need it to be, configuration-wise, and this can't start until the client is installed and working. There does not seem to be any way to prioritize an app install outside of the blocking list.