CMMC L2 - Native commercial M365 desktop apps on a GCC High enrolled device: has anyone made this work in a real C3PAO assessment?

Small defense contractor preparing for CMMC Level 2. Single Windows 11 device enrolled in GCC High Intune (Business Premium + Defender + Purview Suite). CUI lives exclusively in the GCC High tenant.
​
The situation: The same enrolled device also needs access to a commercial M365 tenant for non-CUI business communication. We want to run commercial Teams, Outlook, and OneDrive desktop apps natively on the same device alongside the GCC High native apps and achieve CMMC Level 2 compliance.

​What we are trying to figure out: We are looking for real-world experience from people who have successfully made this architecture work in an actual C3PAO assessment. Specifically what technical controls you implemented to logically separate the GCC High CUI environment from the commercial tenant on the same device, how you documented the separation in your SSP, and whether the C3PAO accepted the architecture as compliant or required changes before certifying.

​Specific questions:
​What combination of Purview, Defender, Intune, and Conditional Access controls did you implement to achieve logical separation between the two tenants on the same device and convince the C3PAO?

​Did you use any additional tools or configurations beyond the standard M365 stack to close separation gaps - third-party DLP, network segmentation, application virtualization, or anything else that actually worked in assessment?
​
​Looking for real C3PAO assessment experience with this specific architecture. What worked, what the assessor accepted, and what you had to change to get certified.