Upcoming changes to iOS/iPadOS Company Portal app deployment for Setup Assistant with modern auth

This is confusing and there seem to be some kinks that Microsoft still needs to work out in the process.

The https://learn.microsoft.com/en-us/mem/intune/apps/app-configuration-policies-use-ios#configure-the-company-portal-app-to-support-ios-and-ipados-devices-enrolled-with-automated-device-enrollment about setting the Company Portal App Config policy states that the configuration "should not be deployed manually to users or devices as this will cause a conflict with the payload already sent during enrollment". 

So does this mean that once we switch from installing Company Portal via VPP in the Enrollment Profile that we will need to exclude all the existing enrolled devices from the new Company Portal app config policy or risk having them be prompted to download the management profile again?