And either provide your modified GPU drivers with regular updates for the whole lifetime of the device (i.e. 3-5 years) or let the GPU vendor do the job. But don't make it hard/impossible to install the GPU vendor's drivers if you cannot regularly provide updates.
Make it easy to find the drivers that you need to install when one sets up the OS newly. I've seen driver websites of laptop vendors where just the complete list of drivers is shown for hardware that might be used in some laptops of the family. Not fun. :-(
Negatiate hard with Microsoft whether you can also provide Windows 10 Enterprise to your customers, where a lot more surveillance functions can be blocked (a large reason why a lot of German companies don't update to Windows 10 - only Enterprise allows decent blocking of the surveillance, but is hard to get).