HI,
Startup task is a good option.
In the startup task you can check if the TLS 1.0 is diables or not.
If NOT disables, Then disable it and go for a reboot.
IF disabled, Then exit the script with success error code
I will check for other options as well.