Thanks MoZZa - that's really helpful.
I'm closer to your 2nd scenario in that I have a single 3rd-party-developed app which we want to run in Kiosk mode. It includes a "take picture/video" option (for uploading media) - which is what triggers the permissions prompt. It did occur to me that there may be a way of creating an app configuration policy to grant permission, but I wasn't 100% clear whether the policy should be for the app I'm deploying, or for the built-in Camera app (?). Either way, it looks to me like I'd need a definition of what settings are possible and the XML syntax for them from the app's developer - or an example of the syntax from Apple (if the policy needs to be applied to Camera). Am I on the right track with either of those?
What I seem to have found with a test device, after posting yesterday, is that by taking the device out of Kiosk mode, but still targeting the app to it, I was able to open the app, agree permissions for Camera, then apply Kiosk mode. Looks to have stayed working, but I don't fancy doing that at scale if I can somehow push a config for it!