If you're using the Jamf Pro Built-In CA you have to go through the process of getting your infrastructure to trust that CA as authoritative for those certs. It would make more sense to utilize your organization's existing PKI infrastructure if you already have that setup.
In order for a device at home to receive certificates you either need to have your certificate server externally facing or use a proxy of some sort. The Azure App Proxy allows for your NDES server to be internally facing only and the App Proxy will proxy the connection to the internal NDES server allowing you to utilize Jamf Pro as a SCEP Pro proxy and deliver certificates over the internet to your devices. You can utilize variables in the configuration profile payload to set values in the Subject of the certificate like the computer name ($COMPUTERNAME) or user name ($USERNAME) if you need those in the certificate.
