I thought in the past you can almost always enroll the latest release of Apple devices even if you have not upgraded your AirWatch or Workspace ONE to a newer version. Am I correct?
If so, the upcoming ones must have something different that requires such compatibility patch to be installed first prior to enrollment.
I just updated from 9.2.3_15 to 9.2.3_28 without any issues whatsoever. Everything ran smoothly, the services came up without problems and new iPhones (XS, XS max) can now be enrolled and seem to work correctly