Apple

Installing from USB is trivial. Apple provides a bunch of reliable tools to do that. It's rarely done, because USB install is pretty slow compared to other install options, but the option is there. Essentially the regular MacOS installer from Apple comes with a bundled script to create a USB install disk.

Bypassing MDM, however, is another matter entirely.

MDM is a firmware feature, not a software feature, and exactly how it works has changed significantly in the last several years. Honestly I don't remember how it works on the 2018 model years - but I would expect it's either impossible to bypass or there are going to be very strict restrictions.

You're probably better off just accepting whatever "junk" they install. Or alternatively, offer to buy it off them. If it's surplus, then surely they're willing to sell it cheap? I doubt they're going to find anyone else willing to buy it. Once you own it, you won't have to deal with the MDM at all.

If it's running macOS Ventura and was previously enrolled into their MDM, every time you install the operating system (OSX Ventura), you will be prompted to connect to the internet which evidently means it will be enrolled into their MDM once again.

You can burn a MacOS Monterey image to a thumb drive, install it on the Mac, and when it asks you to select a network, you skip it, which bypasses the enrollment into the company's MDM.

Burning MacOS on a thumb drive from Windows: Since Windows doesn't have native APFS support, I assume you will need to first set up a MacOS virtual machine (others feel free to correct me, I never had done this due to access to a plethora of Macs I have) , passthrough a USB thumb drive to it, burn MacOS Monterey to it from within the virtual machine and then use it on your 2018 MBP.

This will require some trickery, and the solution itself is a bit hacky, but it's managable.

Like some have pointed out there are ways to circumvent this, but it doesn’t make for a great experience, might cause issues down the line in particular with updates and there’s no guarantee it’ll keep working.

If you’ve purchased this form your company’s surplus and they refuse to unenroll from MDM I’d just give it back and ask for my money back, it’s not worth the hassle and the warranty is a nonsense reason since they can take the MBP off of their warranty service plan.

Yes, it is possible, but it requires that you use a Monterey (or earlier) USB installer. A Ventura USB install won’t work; Apple explicitly “fixed” this workaround in Ventura.

Follow the instructions here: https://gist.github.com/henrik242/65d26a7deca30bdb9828e183809690bd

Essentially, what you’re doing here is blocking the machine from ever connecting to the Apple MDM servers. Once you’ve completed the Monterey installation it is safe to upgrade to Ventura.

You CAN install OS X from a USB but I am not sure if it would bypass that restriction. When I restored my 2013 Mac, I had to install OS X Lion and keep updating it from there, but they may have fixed that issue

No, this won't work. It's based on the computer's serial and the device management profile will be pushed out any time you go online. You'll have to wait for IT to remove it.

The above assumes you want to use Mac OS. You could likely install Linux or Windows and use it just fine.