A key step missing is to set up the iOS device as Supervised in Apple Configurator and prevent pairing with non-Configurator hosts. Additionally, you can install your own non-removable profile via Configurator on the device disabling a bunch of privacy-damaging features there.