Systems Manager with VPP can push iOS apps to devices without requiring the user enter a passcode for iTunes. This allows for app installation without providing the user access to the Apple ID on the device, which greatly increases device manageability. The behavior on install however, is dependent on whether the app is licensed by device serial or by Apple ID. See our VPP documentation for requirements and more information on each method.
For details on how to license and issue app installs, refer to our article on VPP.