From my own experience, Google's own authentication system is not great and we migrated to Entra ID auth. Basically Entra becomes the Login system so that when you enter your username / email on Google Classroom or other google apps, it will send you to the Microsoft 365 login page, and you authenticate their and then it logs you in. I always found this way better, we now use Entra for SSO for all our platforms. GCDS cannot be removed though, it must stay as it handles the provisioning of users from Entra to Google Workspace. Also don't put the Google Workspace admin account into Entra ID so that if there are any errors or issues with sync / login-flow, you still have access to to the Admin console - saves you from being locked out.
Are you planning on keeping on-Prem AD or moving fully over to Intune for all platforms? For the iPads, you should ideally have Apple school manager and Intune for 'zero-touch' deployment.
