The stack overflow thread at Android Device Policy sync does not work until done manually mentions a reboot will force apply a policy, which isn't ideal but it does at least ensure a policy is updated. I'm also testing a fully managed device.
https://developers.google.com/android/management/reference/rest/v1/enterprises.devices/issueCommand details the standard for sending a command to a device. You can test it against live data with the API explorer on that page, so navigate towards the bottom of the page where it says 'Request Parameters' -> 'Name', and put in your enterprise & device ids of the form 'enterprises/your-enterprise-id/devices/your-device-id'. Then go to 'Request Body' and use the '+' sign to add 'type' : 'REBOOT' as a parameter. Press the execute button, in which you will be prompted to choose an account for OAuth2.0. After this, you will see the results, and if successful (returns a 200 code), it will issue the reboot command, with the policy being updated after rebooting.
To reiterate, I know this isn't ideal, but it at least does do an update, so just providing that info.
Good luck and let me know if everything worked out.