Another update on this.
I’ve found how to avoid sending the immediate email, by setting the email_verified parameter to true as per here. This seems like a really odd thing to do but there you go
So the main issue now is simply that the magic link doesn’t work when sent to a user who has been created via the Management API.
What am I missing? How do you make that first time link work on account creation via the mgmt API?