If we're Citrix cloud, can we use WEM on an AAD/intune managed endpoint that will not ever see the internal network and not have access to cloud connectors?

hmm. interesting question sir. I would think it would need to have cloud connectors to pull down the transformer settings, etc. but never tried that.

Please try the enrollment method for it.

I installed and tried to use the enrollment utility and configure enrollment key and it threw back “only wem service agent is supported”

the enrollment only works for the cloud deployment. Which mode do you choose for the agent when you install it?