we're updating BIOS on all devices, as requested by vendor and using Intune CSP for all devices enrolled in Intune as below: 

Configure High Confidence Opt Out = Disabled.

Configure Microsoft Update Managed Opt In = Enabled

Enable Secureboot Certificate Updates = (Enabled) Initiates the deployment of new Secure Boot certificates and related updates

Is this supported also on Win10 LTSC 1809? 

What would be the best option for devices NOT in Intune (like Process Control) or LTSC 1809