Opt-in works for me. As long as they don’t get something like the browser selection prompt - that is a nightmare. No problems with the Dev Mode menu (knock on wood) but I did have to tell them not to install VPN profiles…