Option 3 is to utilize a cloud identity bridge. The JumpCloud® Active Directory Integration that comes as a part of Directory as a Service® offers a very appealing example. This lightweight approach connects AD identities to pretty much any resource that can’t be without delay bound to the Active Directory domain. That can come with not just Mac instruments, but remote Windows machines, Linux servers at AWS, True Single Sign On™ to web purposes, WiFi authentication via RADIUS, and a lot more. This integration with AD federates to a cloud hosted listing provider.
As part of that listing service, IT admins may have full user and device manage over their Mac fleet.