I then created a smart group that utilised the returning information.
Computer group -> Member of -> "Student Computers Enrolled by DEP".
AND -> EA ARD Status -> is -> On. None.
OR
Computer group -> Member of -> "Student Computers Enrolled by UIE".
AND -> EA ARD Status -> is -> On. None.
Members of this group would get a duplicate of the first 'ardkickstart' policy, set to run 'Once per machine', at recurring check in.
So to sumarise:
A computer lab get's imaged and starts going through the DEP process. Our ARD version check runs late during application deployment. When I get to the point of walking away, I log into JAMFcloud and send the MDM command to enable remote desktop on the devices. At this point they haven't finished DEP. As a number of applications have 'recons' attached to their application installation process, JAMFcloud is constantly reporting back via the EA on what the devices ARD status is.
The device will either get added to the Smart group and then run the ARDkickstart script to apply the permissions during DEP (check in policy). Or it'll get to the end and run the macOS version check script that determines if the device has had a MDM command and is sat waiting for permissions to be applied.
I guess it is complicated, but it's working for now!