Firewall being enabled does in fact prevent dynamic discovery of network printers. I found an article that indicated ENS does block this by default on top of RDP and network discovery but the steps outlined to change this didn't seem to point to anything relevant to systems managed by ePO.
Opened a ticket with McAfee/Intel Security and heard back after a couple hours. Suggested switching the firewall into adaptive mode on one machine, reproduce the action that is being impacted then view the Firewall Event Monitor logs. That revealed, I guess not to surprisingly that a rule was blocking 'untrusted' NetBIOS traffic over TCP so I modified the policy rule, specifically for my subnet and domain and boom all works unimpaired as expected.