I am not sure that having 2 different packages can help much here. The simpler way to implement and maintain it is to have an option somewhere in the UI "support provisioning". If it is turned on, device is provisionable. Otherwise it is not.
Even if company has installed the package with provisioning support to the user, he or she can easily remove it and install the version without this support.