It really just depends on how the installer / application is designed by the vendor. When you install via policy, then that install is running as Root, so that install is running with elevated permissions. If the installer PKG is designed to also install any necessary helper tools, then they will get installed without needing the user to authenticate as an admin. However, if the application itself is designed to install additional Helper Tools at the time of launching the app, then the user gets prompted because the app is running as the user, which doesn't have elevated permissions. I think Slack, Signal, and WhatsApp try doing this to install an auto-update Helper Tool. Some applications, like Docker, give you terminal commands that you can also execute via policy to take care of these Helper Tools post-install, and in other circumstances you can use Composer to build a custom installer PKG that also captures helper tool installs / basic preferences by performing the install on a clean system and comparing before and after snapshots.
Some other ways to avoid these, though not perfect, would be to utilize the new Jamf AppInstallers functionality (Slack is in there) or deploy macOS AppStore versions, but that has historically been unreliable. You can also use something like SAP's Privileges app to allow users to temporarily request admin rights, but your orgs risk tolerance may not allow that scenario.
