MDM without Apple Business Manager on a Macbook

I’m new to working with Macbooks and need to quickly provision one for a contractor. I need to setup MDM (something like Jamf or Mosyle) on the device. But I don’t have an Apple Business Manager account and won’t be getting one (it’s just one laptop I’m provisioning). From my reading, it seems like the way to do MDM without ABM on a Macbook is as follows: 1. Create an admin account on the Macbook 2. Add the MDM to the Macbook using the admin account 3. Setup the user as a standard user account and manage it with the MDM 4. Never give the user the login for the admin account Am I correct that this is the best way to add and enforce MDM on the device without an ABM account? My understanding is that this method still allows the user to perform a full reset of the device and then do what they want with it. But if they don’t reset the device, is their ability to circumvent the MDM blocked? Any pointers for this situation would be greatly appreciated.