S/mime in a complex Environment

I need to implement Smime certificates in an organization, 

The environment is as following:

-Active directory has a domain different than the domain used in -M365/Intune/Exchange online thus there is a UserPrincipalName mismatch.

-User's identity is federated and provisioned using Okta to M365 thus no AD connect running.

 What would be the best way to achieve this? In detailed steps