Employee needs to download Microsoft Remote Desktop (sorry, Windows App) that is only distributed through App Store.

Employee does not trust the company having access to everything else in their personal iCloud account - photos, mails, messages, calendar, reminders, etc.

Employee registers a new Apple ID with company email, as it would be only used for downloading one single app.

Got it. It’s registering with the company email first, not their personal one.

I think the idea is that it happens before they lock the domain as a business. Before that, if you have an email address you can create a personal account with it.

yes, that's exactly how it happens.