I'm looking at similar issues. I have 4 apps I need to included and have installed by the time the user gets to logon (including a VPN software). I'm going to bundle everything into one Win32 app and install that way and block ESP on that single app. Its also hybrid joined enrolment policy.
I'm confused on what to do with the MECM agent though. See https://learn.microsoft.com/en-us/mem/configmgr/comanage/how-to-prepare-win10 it states
You can't deploy the Configuration Manager client while provisioning a new computer in Windows Autopilot user-driven mode for hybrid Azure AD join. This limitation is due to the identity change of the device during the hybrid Azure AD-join process. Deploy the Configuration Manager client after the Autopilot process. For alternative options to install the client, see https://learn.microsoft.com/en-us/mem/configmgr/core/clients/deploy/plan/client-installation-methods.
So how to deploy after the autopilot process?