DEP only controls how the device is assigned to your organization pre-enrollment. If they are enrolled, managed, and supervised by an MDM, then that MDM can send remote management commands (OS update commands being one example) to the device regardless of DEP.
