From HP Forums
Apple has a Tech Note on this.
Unfortunately, they way it currently works, you would still have to touch each remote machine and turn off this level of security to allow the remote install.
https://developer.apple.com/library/content/technotes/tn2459/_index.html
For enterprise deployments where it is necessary to distribute software that includes kernel extensions without requiring user approval, there are two options:
If your workflow is based on imaging, boot into Recovery OS and use the spctl kext-consent command. For detailed information about the spctl command, run the command spctl help. This command can either disable the user approval requirement completely or specify a list of Team IDs whose KEXTs may be loaded without user approval. The spctl command works in any installation environment, including Recovery OS and from NetBoot/NetInstall/NetRestore images.
Note that the Team ID list maintained by spctl is separate from the system-wide policy database.
The extension being installed is hp_io_printerclassdriver_enabler.kext which is required for some printers.
