Im working on a blogpost which allows you do register your first device from external if you havent enrolled a token so far. After this enrollment and mgmt is only possible inside the company