MS 365 E5's, mobility and Endpoint protection

Good Evening,

 

Looking for opinions. I have what is effectively a greenfield site which will use MS 365 E5's, EMS and AADDS along with InTune to domain join and deploy Win10 devices.  We will have no in house infrastructure and therefore no real corporate network, mobility is key, as is End Point protection.  

 

What are people using out there over and above Windows defender?

 

Best Regards,

 

Bob