Hey @tngacker,
This is some good investigative work!
I do think this rules out any connection issues to the data stream from a networking perspective! The device is getting blocked before it can even open up the stream.
Are the devices that you are working with Supervised by chance? If so, I wonder if it would be possible to set another device restriction in order to prevent the user from being prompted with this?
https://support.apple.com/guide/mdm/supervised-restrictions-for-iphone-and-ipad-mdm54960f92a/web
Modify personal Hotspot settings
Modify eSIM settings
Modify cellular plan settings
Modify cellular data app settings
However, I would definitely open up a Feedback with Apple on this as it is a unique edge case.
https://feedbackassistant.apple.com
What I imagine you as the admin are expecting to happen would be for the application to be installed and for the device to go into single-app mode, but due to the "user" having control over the cellular plan you are not able to accomplish this. If the device is supervised and one of the above restrictions cant help with this I think Apple would consider making a change to the protocol to support your use case.
Hopefully one of the above restrictions can help get this solved for you!