how do we strictly enforce and lock data roaming on samsung deployments?Solved

Since your fleet is entirely Samsung hardware, you should absolutely use the Knox Service Plugin. It is the gold standard for locking down specific device settings. Navigate to Policies, select Android, choose Knox Service Plugin, and click Configure. You can enable the data roaming policy directly through that plugin. Since it is a Knox level command, it pushes the configuration straight to the system architecture and should enforce your requirement.

I appreciate the navigation paths, but I actually just finished testing that exact method with our QA team. We pushed the policy to our Samsung devices, and while it successfully flipped the data roaming toggle to ON, it did not gray out or lock the setting at all! The user is still completely free to manually turn it back OFF. Did we miss a secondary lockdown step in the configuration? 

You did not miss a step at all. @mo-chou gave you the correct standard procedure, but you just collided with a known vendor level limitation. 

While the plugin is supposed to be the ultimate lockdown tool, forcing data roaming into a permanently locked ON state is just not fully supported within the Knox Service Plugin right now. It executes the initial state change to ON, but it completely fails to gray out the user interface element. 

Because the plugin is built, updated, and maintained entirely by Samsung, this is fundamentally a Samsung defect rather than an MDM issue. Your best path forward is to raise a support ticket directly with Samsung Knox and report the UI failure. Until they patch the plugin on their end, there is no magic secondary step to stop users from overriding it.