The new macOS agent is implemented as an Apple MDM profile and includes the new Device Lock feature. Lock out at-risk macOS assets in pre-boot, with a customized message and a bypass password.
Look for the new macOS MDM profile in Settings / Agent Deployment / macOS/iOS.