Entra Connect Cloud Sync One Way w/o Passwords

We are setting up a separate tenant to separately control access to certain resources. I've setup cloud sync without password hash and I've setup the Sync Direction only one way (AD to Entra)

Based on everything I'm seeing and reading I believe this will do what I want:

1. Sync from On Prem to New Tenant Only, no writeback
2. Passwords will not sync so users will have distinct logins
3. Users will be disabled when disabled on prem.

I believe we will have to set the initial passwords separately in the new tenant, but at least the above automatically creates the accounts, let's us use the same ad groups, and automatically disables on termination.

Can anyone confirm my thinking is correct? Anything else I should think of? I'm sure there are other ways to do this with the APIs, but for our size and scale, this will get us started.