In evaluating other MDM services, I've found that enrollment that requires some kind of end-user authentication automatically satisfies the User Approval portion of MDM enrollment when initiated using DEP.

This is, of course, in addition to the security concerns of anybody with a DEP-included serial being able to enroll without authentication.