Groups Tags & Entra Groups without Autopilot

I have a multinational company I wish to onboard their Windows fleet into Intune for App and Policy deployment, however I won't recommend them to use Autopilot (AP) as they are hybrid (for now)

Group tags will likely be advantageous here so I can target certain things at different countries (e.g regional settings)

Will Group tags and the assoc Entra dynamic group/s targeting those tags (devicePhysicalId) work ok in the absence of going through the AP process? I think this config will be agreeable if/when they go Entra joined.

I suppose when they build a new PC, the IT admin will manually join to on-prem AD, (login via end user via TAP?) then let GPO enrol into Intune/deploy apps + policy.

Or am I better to attempt AP with hybrid in the hope this is a short-ish solution before Entra join?