The aim is to prevent even root users from uninstalling our app on their mac.

You as a 3rd party developer can't prevent the root user or users with root privileges from uninstalling apps that they can initially install. One one admin can do another can (un)do.

IT, however, can manage this through the use of MDM (Mobile Device Management). Once installed, IT will be able to create and enforce policies allowing/disallowing software use and installation.

This is for IT to manage, not the developer.

The aim is to prevent even root users from uninstalling our app on their mac.

You as a 3rd party developer can't prevent the root user or users with root privileges from uninstalling apps that they, technically, can install themselves. What one one admin can do another can (un)do.

The core OS is protected by SIP and if using Catalina or later, the system volume is read only. This is implemented at the very base layer and not at the application layer where you operate.

IT, however, can manage permissions, rights, and roles through the use of MDM (Mobile Device Management) software. Once a device is enrolled, IT will be able to create and enforce policies allowing/disallowing software use and installation.

This is for IT to manage, not the developer.