Yes, #3 is a pretty good strategy and I see it often used in larger / automated environmemtns. I think of this Filebeat Setup Host / Install.
You should run setup whenever enabling a new module or when deploying a new version of filebeat across your landscape
The version part is equally important as the templates, pipelines, dashboards can be updated, and templates and pipelines definitions include the version number.
To be clear you do not need to run setup on every host, VM, pod, container etc.