Hi Pelle-netpack, thank you for your question! One admin user on a Mac is required, so you need at least another user to downgrade that initial admin user. To downgrade an initial admin user, you can use a script to make that user a standard user. Or you can use platform SSO to define user rights (as a new user, and as a persistent user).

It is on our roadmap to add local admin configuration settings within the macOS enrollment policies so you can do this directly from the enrollment policy (configure both an admin user and a primary standard user from the same enrollment policy). 

Thanks for participating in today's session of AMA: Securely manage macOS with Intune! For reference, the panel covered this topic at around 6:30.