Default NE9 OTA and go back to stock?

Trying to solve this for a friend.

We're on the pre-NE9 release and I used Towelroot to get the phone root. This was critical because we were migrating from an old S3 to the S5, so it was easier to use Titanium Backup to bring back the apps and savegame data.

Well it turns out my friend needs to run MDM Airwatch and Root cloak isn't working anymore. TBH there really isn't any reason to keep the phone rooted because it just makes OTA difficult too. So I think we're ready to go to an unrooted state.

So the first thing is we're struggling that even after doing a full unroot via SuperSU uninstalling Towelroot, it still doesn't pass MDM. So if anyone has a suggestion go ahead.

I'm not sure whats wrong but even then the OTA won't install either, so I'm suspecting the phone still finds something not in stock state.

So here's my question: Is it possible to install the OTA via Odin and ensure that the apps/data are not lost? I've heard that there's a lot of reasons OTAs can fail, so its more reliable to just use Odin to get the OTA applied. I figure that once we get the OTA updated, perhaps MDM will pass? If not we can always factory reset at that point.
Current:
OnePlus One | CM 11S | Nexus 5 | crDroid for Nexus 5

Legacy Devices:
LG Nexus 4 | CM 11 Nightlies | Google Nexus 10 | CM 10.2 Nightlies | Samsung Galaxy S2 i9100 | CM 11 Nightlies | HP TouchPad | CM 11 Nightly 06072014 | Nexus S i9020a | CM 11 Nightlies | Motorola Milestone | CM 7.2 (16.06.2012)

Battery Testing - Non-BS, Non-Subjective Testing