It checks again unless the user cripples the service (which requires access to disable System Integrity Protection), and even if they do it will be undone after

It checks again unless the user cripples the service (which requires access to disable System Integrity Protection), and even if they do it will be undone after am update. But it requires the user to accept the enrollment (just a couple clicks on a pop up). I don't know that that can be changed. During OS install the enrollment will just happen; the user's acceptance is not required.