Well, to comment. I don't see that I am "mixing up about half a dozen different things" at all. I have tried half a dozen different things, at least, most without success.
In a web forum context, you are going to have to take things one step at a time, slowly.
I *am* the IT person at this State Pension Fund administrator and responsible for network security. Organizations like ours are high-priority targets for hackers, including state sponsored actors. We have over 4,000 attempted break-ins to our system monthly. Security is one of our top priorities. I am well versed in the vulnerabilities of Windows and we routinely have a US Military cybersecurity team test our network -- internal and perimeter -- for penetration vulnerability. This same team recommended Mac workstations for a better level of OS security, which is why we are experimenting with Macs. Security in today's world is a *very* serious matter, hardly "snake oil".
Security is very serious, but most security being sold these days is a little more than snake oil. Any server on the Internet is going to have many hacking attempts. That doesn't necessarily mean that they are from state sponsored actors. The US military has some very good cyber security people, but those people do not offer their services for hire. Any successful security snake oil salesman is going to tout his military experience. That doesn't mean it was good experience, or even that it happened.
Apple’s products have a very good level of device security, but they are not appropriate for servers. This sounds like a mismatch between the security being sought and the risks that you face.
These forums are Apple's free, consumer level technical support service. That does not seem appropriate for a state pension fund. There are only a few people in this forum you have any real enterprise admin experience and I am not one of them. I don't know my kerberos from a hole in the ground. Why don't you just call you your Apple rep and get some on site Apple engineering help for this issue?
I said I had successfully used nfs with autofs on Mac, but do not want to use autofs as the mechanism to backup up to network drives. I did not say cifs or smbfs did not work with autofs -- I did not try those, but given my experiences trying those mechanism with password issues I don't know that I could get that to work.
That's why this is confusing. You said you tried NFS I don't want to use autofs because it mounts as root. That's how it works, but fair enough. Then you said you didn't try SMB, because when you tried it it didn't work. That makes no sense.
If you know of the correct syntax for specifying a SMB mount with AD without password, please share that. I've experimented every way I can think of (pretty much all attempts posted in this thread), and done hours of searching and have been unable to accomplish that.
I am no longer working for the organization where I did those autofs mounts. I don't remember it being very difficult. With a Mac bound to the Active Directory domain, automount entries worked pretty well with no password required. I don't know if this type of network connection is appropriate for your use. While the auto mounting itself worked pretty well, other parts of macOS are pretty flaky where networking is concerned. My official recommendation would be to start a new thread and describe what you really want to achieve with these Mac workstations, at a high level. At this point, I think you are getting stuck in the details of one particular rabbit hole. But regardless, here's what I found:
Here is a bootleg link to Apple's old autofs documentation. Grab this link while you can because if any Apple moderator sees it, they might remove it. https://loga.us/wp-content/uploads/2014/09/Autofs.pdf
(I have been actively complain to Apple about their annoying habit of deleting documentation.)
Here are an old thread of mine from back when I did have the autofs working.
autofs not working properly now! - Apple Community
I thought there were a couple of other threads like this, but I can't find them. The forum software was recently rewritten and searching is a bit of a challenge right now.
Someone once posted a link to this page, which was surprisingly accurate: http://blog.grapii.com/2015/06/keep-network-drives-mounted-on-mac-os-x-using-autofs/
And finally, someone once posted a link to this app which might help: AutoMounter on the Mac App Store