Anyone ever create an enrollment for a single user?

What is needed to be different? Policies, Configuration Profiles, Enrollment Customizations, etc.?

• Enrollment would need a separate prestage, devices would need to be manually assigned to it.
• Policies should be handled with a smart group targeting some unique attribute for that user like devices assigned to them.

It could be too much overhead to set up, but depending on how locked down you're getting, a separate site in your JSS could also accomplish this. I've done the opposite - set up sites for folks who don't get certain default policies ever (VIP/white glove setup, OEM testing but inventory enrolled, etc).  If you don't use sites regularly, it's easy to forget about them when working with your full inventory.  

It probably makes sense to set it all up in your main JSS as clamped down policies with smart groups as mentioned above, but just offering alternative ideas.

I remember doing this for BYOD devices, but I don't, any more. 
You can technically add additional policies to specific people as the most restrictive combination is used. 

If you're going with a separate site, remember that site:none apply to all, and a specific site applies only to members of the site.