Was just posed with this question/request yesterday about setup and enrollment using Centrify smart cards authentication before JSS enrollment externally and internally.
A Windows co-worker told management, yes we can enroll Mac's this way with or without DEP to out external facing JSS.
JSS current setup. Basics
JSS internal Mac management global SQL Server
DP's setup globally
JSS - port open to the SQL server
Https share - external facing users only
Tried talking about switching to JAMF cloud, but our security group just is not going there.