Your 8-minute latency benchmark for critical app availability is the key metric. We observed a similar distribution, but the 70th percentile latency was closer to 12 minutes in our environment.
This points to the sync buffer being a variable, not a constant. It's dependent on the geographic location of your Intune instance relative to the user's device and the current load on Apple's services. Designing for a 5-minute buffer because it worked in your pilot might fail during a regional onboarding event.
The only reliable pattern we found was to trigger the first Company Portal launch via a device configuration profile set for a 15-minute delay post-enrollment. It's overkill for most devices, but it brought our "empty catalog" support tickets to zero.