If you are going to be managing Macs and plan to use any software that is NOT available in Apple's App Store (this includes Google Chrome, Zoom, Asana, anything from Adobe, etc.), then look into Jamf Pro. If you have 50 units, you can purchase direct from Jamf. If you have less and want to offload your management, look for a Jamf MSP partner as we can start customers with as few as 5 devices.
Other MDMs, from Apple's Apple Business Essentials, to Mosyle, to Intune, are great for iOS/iPadOS devices or for Mac environments that exclusively use App Store apps. Once you need to deploy and manage external apps, the other MDMs show their weakness. We have one customer that fits this role and it is a law firm that uses Pages for all written work, Preview for PDFs, and Mail/Contacts/Calendar for connecting to O365. They are the unicorn from our view. Nearly every other customer has some required piece of software that is not in the App Store. This may be a VOIP app, a productivity tool, or just an alternate browser.
As for DLP, there are a number of options. If you go Jamf, you can add in Jamf Protect and this will provide an extension to DLP by offering the ability to set removable storage policies. The other one I have the most experience with and generally recommend is Microsoft Defender for customers already on Microsoft cloud services. If you are using E5 licenses you already have access. However, you can add Security and Mobility to a Standard or Basic license to unlock the Defender admin portal. Configuring DLP in Defender is a little rough around the edges but in typical Microsoft fashion this will get ironed out in time. This is the core Defender setup https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide and this is for device control https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-device-control-overview?view=o365-worldwide. Additional DLP options can be found on the links on those pages.
Remember, Apple Business Manager is all about chain of custody. ABM creates an agreement between your legal business entity and Apple. With the agreement you can link hard assets (Macs, iPhones, iPads, etc) and soft assets (apps and books from the Apple stores). In addition, ABM can also integrate into your identity provider (Microsoft), allowing you to federate the service and allow directory sync. This sync process can allow you to automatically support Managed Apple IDs. While we generally try to avoid using Apple IDs on supervised devices, there are some cases in which an Apple ID is required. However, Managed Apple IDs still have a lot of limitations (see Use Managed Apple IDs in Apple Business Manager - Apple Support) so even if you integrate ABM, there may be cases where a user must create a regular Apple ID.
Hope this is helpful.
