We only just got ABM setup and our first Mac enrolled and in my experience so far the iPhone app and that process works great, but when the user goes through the initial enrollment they sign-in with their company email to "enroll" but then they still are given the steps to create a local account. This first account, like normal Apple behavior, is a local admin. Additionally, you have to deploy the Company Portal app as a "required" assignment and the user has to sign-in to it to complete the Intune enrollment.
We only have one Mac setup and so far it wasn't too bad, but it would be nice if their AzureAD account was the local account and that we had control over whether or not that was an admin account as well. There are a number of other options related to MacOs that I have yet to explore so I'll be curious to hear what others respond to you regarding your questions as I have the same ones.