Standard approach to having a cluster with separate master and data node

Lets say i want to have a cluster with 3 master only nodes and a data only node. What is the best practice to build such a cluster. Is there a way to to make it happen without having at least a node that is both master and data node. one way that i tried that kinda worked was to first build a cluster of 3 master only nodes with no shard in cluster and then adding a data only node to the cluster but the problem with this approach was handling the TLS related part because when you begin you cluster with the master only nodes then you can not use elasticsearch-create-enrollment-token utility even with -f parameter. So the question is what it the standard procedure to build such a cluster.