You will need to set up a CA in order to use SCCM. SCCM requires TLS authentication for vPro clients, meaning that you will need a CA to issue certificates to you vPro clients when they are provisioned.
In addition, you will also want to purchase a remote configuration certificate. You can find information on how to get one in the remote configuration FAQ:
Look under the heading "What resources or guidance are available for acquiring one of the core external certificates?"