What I've done is create an enrolment wireless LAN
Create a profile for the enrolment wireless in apple configurator with auto join on
Along with auto device enrol and trust certificate just the bare minimum to enable enrolment
As you'd normally want to do most configuration from your mdm
In the mdm I've configured profiles for the wireless I want the device to connect to and enable auto join eg staff
And any other profiles required for the user, mail, VPN, ldap etc
Use apple configurator to prepair the device and get in enrolled
Once it's enrolled it will have whatever profiles you've configured in the mdm for the device
Turn off the enrolment wireless LAN and the device auto joins whatever wireless you've configured in profile manager
If you turn the enrolment wireless back on it won't auto join the enrolment wireless unless the wireless you've configured in profile manager and pushed to the device is off or it can't connect for some reason
If any wifi changes are nessesary turn your enrolment wifi back on and push out whatever you need
Having the enrolment wireless give you a sort of back door into he device when needed