Adding functionality to macOS pre-boot process
Apple doesn’t prevent you from running other EFI unless you have trusted OS / T2 chips. You can disable these security steps on Mojave and current T2, but that’s pretty manual and not automated.

You’ll want to look at tools like BootRunner or the two canoes MDS with automaton to automate the pre-boot environment for all modern Mac hardware and modern macOS.

Much easier to handle things with the tools Apple gives than trying to re-engineer EFI / customize things that don’t have sanctioned support. Extending PAM / authentication is long supported, but changing EFI is not something most enterprises take on in my experience.