would access rights per client IP work for you?

if you want per user, then kerberos, or as u/RedditSlayer2020 has said, use SMB

hmm, for Apple a MDM Push certificate is the link between the two, for Google the managed play store, neither of these have a “requirement” for a SaaS solution.

both of these are just to connect the device to the MDM platform via a “managment profile” (waves hands), the settings and enforcement is all on the MDM platform.

A very long time ago (the days of the 3G) I had an internal web server that hosted iPhone configuration profiles, it was very (very) “basic”

Granted this is only for Apple (and with a last commit in 2022 might be dead) but is useful for showing what part connects where to do what.