One "issue" you might encounter are access restrictions for the various clients. To workaround this issue in the past one of my customers had the option of either using amp4endpoints private cloud edition or use specific proxy servers that would allow access to the amp public cloud from the amp connector and nothing else.
I would recommend starting with all engines in audit-only mode, having false-positives in such an environments could create some massive waves causing a endpoint security initiative to be delayed unneccessary, but apart from the internet connectivity and stability requirements there are no amp specific recommendations I can think of.
If you have some specific questions let us know
