licensing requirements for Azure Conditional Access

1) With PREMIUM P1, we have all possibilities tasks achieved such as Core Identity and Access Management, Identity & Access Management for Office 365 apps, Premium Features such as Banned password, SSPR, MS Cloud app discovery, Azure AD Join & bit locker, and most of the conditional access policy except Identity Protection such as Vulnerabilities and risky accounts detection, Identity Governance (PIM access review & approve) will be possible only with Premium P2

2) Office 365 E3 has limited features than Office 365 E5, however in my opinion plan the infra with the latest features to use M365 E3 + limited license for security admins to have O365 E5 or Microsoft 365 F5 Security + Compliance Add-on.

Thanks!