Hi Steve, what you described is the usual method. Downloading the installer from Central and running it on Big Sur should work just fine, although the endpoint will not be protected until it is assigned to the EAP.
We'd usually ask for an SDU but without the product installed that won't work.
If you could zip up our diagnostics logs and share them with DropBox or OneDrive or something similar that would be great. You can DM me the link and I'll get them to an engineer for analysis.
