Docs RFE (probably Provisioning Guide could be a good candidate):

When RHEL8 kickstart BaseOS repository is synced, Pulp automatically includes all sub-repositories as unmanaged repositories. This effectively mean that AppStream sub-repository these cannot be managed, only published or promoted but it is not possible to filter packages, errata or any advanced operations.

In order to successfully provision a RHEL8 system, both BaseOS and AppStream repositories must be present. Therefore we need to recommend to always kickstart systems from repositories without any advanced content operations (I am not sure if "unmanaged" is a good term we should probably find something) and configure systems to subscribe to managed content after installation by providing valid and fully managed content view with RHEL BaseOS and AppStream as well as additional repositories.

Hope it makes sense, this is not my expertise so probably someone from Katello or Pulp could fill the details.

https://projects.theforeman.org/issues/33676