@Mountain Pond Thanks for posting in our Q&A.
For Q1:No, there is no such setting. We just can configure the PIN for the managed apps in the app protection policy.
For Q2 and Q3: Honestly, there is no any setting about hotspot we can configure via intune. Currently, intune only can deploy Wifi profile to the Android device.
https://learn.microsoft.com/en-us/mem/intune/configuration/wi-fi-settings-android-enterprise
And based on my research, google MDM develp document doesn't provided this feature.
For Q4: To clarify this issue, could you please check if the app protection policy is successfully deployed to the target user? Please click on Troubleshooting + support > select the target user and check if the managed app shows green icon under App protection status.
For Q5: I didn't find someone deploy PowerShell scripts on android devices. Currently, we get the android enrollment profile via the following methods:
https://learn.microsoft.com/en-us/mem/intune/enrollment/android-dedicated-devices-fully-managed-enroll
For Q6: Intune doesn't have the feature to publish a contact list. Did you consider to manage mail contacts in Exchange Online?
https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-mail-contacts
If yes, please refer to the following link, it will sync outlook contact to native contact.
https://www.inthecloud247.com/automatically-configure-outlook-contact-sync-to-the-native-contacts-app-with-microsoft-intune/
Note: Non-Microsoft link, just for the reference.
However, it still doesn't have the ability to prevent users from editing the contact list.
Thanks for understanding.
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.