If you devices are enrolled in Endpoint, you should be able to push the Defender app to them using volume licenses synced from ABM/ASM. Depending on how you set up your groups, you can assign the app to user or to devices as a Required install. The link in your post has most of the instructions you need to do this, but you will need to upload an ABM/ASM location token to Intune/Endpoint rather than adding the app as an IOS Store App:
https://docs.microsoft.com/en-us/mem/intune/apps/vpp-apps-ios
We use Endpoint to manage our mobile phone fleet, and while it is not nearly as intuitive as Jamf, it does have a good bit of the same functionality.
