Apple Configurator (self-hosted local MDM, free macOS app in store) has an option for "supervised" iOS devices so that Wi-Fi connections are limited to SSIDs which are pre-defined in the MDM profile. It's intended for enterprise usage. Worth testing to see how MDM policy interacts with carrier-managed Passpoint networks.
Note: you can't supervise an existing device without wiping it, so this is an experiment to conduct with a spare phone, or one already managed by Configurator/MDM.
Note: you can't supervise an existing device without wiping it, so this is an experiment to conduct with a spare phone, or one already managed by Configurator/MDM.
Apple Configurator training: https://it-training.apple.com/tutorials/deployment/dm095
Wi-Fi payload: https://developer.apple.com/documentation/devicemanagement/w...
Another option is using Apple's MDM for small business to define a list of approved SSIDs, https://www.apple.com/business/essentials/
Edit: is there an option to "Remove Profile" in Settings?
Edit2: workaround by null routing the carrier's Wi-Fi SSID? https://www.reddit.com/r/tmobile/comments/vvt6dd/comment/iyr...