hmm, for Apple a MDM Push certificate is the link between the two, for Google the managed play store, neither of these have a "requirement" for a SaaS solution.
both of these are just to connect the device to the MDM platform via a "managment profile" (waves hands), the settings and enforcement is all on the MDM platform.
A very long time ago (the days of the 3G) I had an internal web server that hosted iPhone configuration profiles, it was very (very) "basic"
Granted this is only for Apple (and with a last commit in 2022 might be dead) but is useful for showing what part connects where to do what.
would access rights per client IP work for you?
if you want per user, then kerberos, or as u/RedditSlayer2020 has said, use SMB