Apple documents that devices prioritizepreferred networksfirst - these are networks the user or MDM has explicitly joined and saved. If no preferred networks are available, devices then attempt to joinprivate networks(those that do not broadcast public hotspots but are available locally). Finally, as a last resort, devices may joinpublic networks, such as captive Wi-Fi portals or unsecured hotspots. Apple Learning highlights this hierarchy to ensure consistent enterprise behavior and user experience. Administrators can influence priority through MDM-delivered Wi-Fi payloads, placing organizational SSIDs at the top of the preferred list. Public networks are deliberately last in the sequence because they are less secure and more likely to involve captive portals, which disrupt automatic connectivity.
References:Apple Platform Deployment - "How Apple devices choose Wi-Fi networks."