Managing Defender AV in Passive Mode with MEM

We have just deployed MDATP and are looking at EDR in block mode but need Defender AV in passive mode and updating for this to work. Can we deploy an Endpoint Protection policy from ConfigMgr with just the Cloud Protection and Security Intelligence updates configured? Right now MDATP is showing the AV as disabled and not updating which appears to be because of a massively outdated engine and there being no update schedule defined.