Thanks @ChuckMN!
On iPads where we don't have Single-App Mode enabled, we will get a popup that says Download "<App>" Using Cellular Data? Using data over a cellular network may incur additional fees..
If we click OK to approve that, the download and installation proceeds smoothly, so is it fair to eliminate issues to do with connectivity to the app download server or TLS certificates?
Is there some way of suppressing this popup and permitting downloads from the MDM?