policy (aka profile) assignment and activation for vms protected by appliance

In the Trend Micro Deep Security SOAP API (DSSOAP.ManagerService) are the following methods okay to use for appliance-based protection?

securityProfileAssignToHost()
hostAgentActivate()

Or only for agent-based protection? If only for agent-based, is that requirement documented anywhere?

Yes, you can use those methods for appliance protected objects. (I work at Trend Micro as a CSE)

Here is a basic example of how you can use those methods in PowerShell:

param (
    [Parameter(Mandatory=$true, HelpMessage="FQDN and port for Deep Security Manager; ex dsm.example.com:443")][string]$manager,
    [Parameter(Mandatory=$true, HelpMessage="DeepSecurity Manager Username")][string]$user,
    [Parameter(Mandatory=$true, HelpMessage="HostID to activate")][string]$hostID,
    [Parameter(Mandatory=$true, HelpMessage="Policy ID to assign to Host")][string]$securityID,
    [Parameter(Mandatory=$false)][string]$tenant
)
$passwordinput = Read-host "Password for Deep Security Manager" -AsSecureString
$password = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($passwordinput))
[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true}
[Net.ServicePointManager]::SecurityProtocol += [Net.SecurityProtocolType]::Tls12
$DSMSoapService = New-WebServiceProxy -uri "https://$manager/webservice/Manager?WSDL" -Namespace "DSSOAP" -ErrorAction Stop
$DSM = New-Object DSSOAP.ManagerService
$SID = ""
try {
    if (!$tenant) {
        $SID = $DSM.authenticate($user, $password)
        }
    else {
        $SID = $DSM.authenticateTenant($tenant, $user, $password)
        }
}
catch {
    echo "An error occurred during authentication. Verify username and password and try again. `nError returned was: $($_.Exception.Message)"
    exit
}
$activateHost = $DSM.hostAgentActivate($hostID, $SID)
$assignPolicy = $DSM.securityProfileAssignToHost($securityID, $hostID, $SID)
$DSMSoapService.endSession($SID)