Not able to enroll a DEP Macintosh system using a Wi-Fi connection

Are your network people using Network Access Control? Can't you pre add these devices to your NAC? What do you do with iPad Carts as those would be treated the same? We use a NAC and for self enrollment to the WIFI the users can authenticate as themselves. But for institutionally owned devices we pre register those Mac Book Pro's Like iPads. Your Windows devices with SCCM are pre-registered into your AD domain. You should be able to do the same with your Mac Book Pro devices. They might say that in windows we don't have to pre-register but they do with the Wifi and they use AD authentication for Wifi Via group Policy. The AD guys can create the profile in the JSS for you and not give you access to modify it. They would have total control of the profile with AD service account auth.

iOS as of a few versions ago supports username:password on the Wi-Fi during setup, only Apple could tell us why this is not supported on macOS during setup, it's a pretty big oversight on their part.

DEP enrolment over wifi for macbook, requires wifi authentication, theres two options.

1. with wpa2 home, users will need a profile to install to authenticate to the wifi to allow enrolment
2. with wpa2 enterprise, users will need to auth against their own wifi account fro the local admin account to allow enrollment.

Follow up to 1. is that its not very secure and it isn't helpful for tracking network usage, if a generic account is used. It would also have to be installed via USB.

follow up to 2. is the profile cant function until device is domain is joined. and a wifi connection is needed to do this step. So the user would need to pre authenticate the wifi using their credentials before, DEP process can be started.

For brand new devices, the recommended process would be to:
have the end user to create a specific admin account and password
have the end user to connect to the wifi using their user credentials over wpa2 entperise (via a radius nac configuration)
have the end user enroll the device manually, or via DEP (i prefer manually, the DEP prompt in my experience is not easily anticipated).
create a management account on the device through the enrolment process
push a wifi profile which allows for authentication of wifi from the login page.
enforce a reboot after enrolment is complete.

Instruct the user to login using their credentials after the reboot, and have a script to run to delete the generic user account they created upon first start up.

This will ensure the user can login against their Ad user, and their generic admin account is non existent after login.

you could later have the pre auth wifi profile to remove after X amount of days, but the end user will need to be aware of this, as they would then need to re-auth their wifi after login.

Can you have the network team set up a "Guest WiFi" with access to the internet but not the internal network?

At that point, it would be treated the same as your home Wi-Fi, a public library's Wi-Fi and from a community recreation center's free Wi-Fi.

Once the enrollment is complete, you'd be able to connect to the internal network.

yeah the guest method will work, but the downside will be that it wont domain join them straight away, as you will need to be on the internal network for this part.