Contoso allows employees to use their personal iPhones for work email and approved apps. The security team requires that Intune manage only corporate data and that users complete enrollment themselves through the Company Portal, with each device tied to the enrolling user. No Apple Business Manager tenant is configured. Which enrollment method should you use to meet these requirements?