One of the FIRST places you will notice a challenge, is pushing agents.
When you push an agent, and provide the credential that will query AD then connect to the remote agent and push it, you are actually spinning up a local MonitoringHost.exe process under that credential to do the Agent Push. This works the same as a typical RunAs account, and ANY account you want to use here will require Log On As A Service.
What you might notice is a failure to “find” the agents you are trying to deploy: