Well, first they are lying to you. You don't have to hand out certificates manually and that isn't how Intune does it either. They are provisioned using SCEP generally, which has its own security drawbacks. You can get these certificates from a SCEP server using a tool like Certmonger.

Most companies that say they don't officially support Linux already have you sign an acceptable-use agreement to only use company-provided hardware and approved software. And while they may act like they'll make a special exception for you, you better make sure you got it in writing and in a way that would comply with your other employment agreements. One thing most IT employees don't have the privilege of is negotiating the legal terms of their employment. There are already multiple US cases of employees being criminalized for breaking their employer's AUP.

I wish you the best of luck, but feel like you're prob in for a harsh reality.