Configurator if you have a MacOS device already and want the OG. Plus it does allow for device supervision. Although you may have to register as an enterprise system for that. That’s really going to be the key thing here as last time I recall signing my org up for MDM we had to provide tax documents.
Apple uses JAMF, and their prices are so low and it’s so easy that for strictly Apple devices I’d go that route. I do believe there is an on prem version of Jamf as well, but you still pay yearly for it.
There’s also Hexcloud, whatever VMware is calling there’s now, and technically sccm can do device MDM.
Main benefits come from supervised mode. On iPads you can enable multi user support with sign in. You can remove access to messaging or other apps, but beyond that the differences between MDM and parental locks aren’t as wide.