Thanks for already partially answering your question. 
You are correct The additionalNamespaces at this moment does not support go templating. This means that they have to be static, or you use "*".
If you create namespaces in a dynamic way, you’ll have to also ensure the pull secret is created, which is very similar to using operators with kots.
Additionally, you might want to check how to manage namespaces in a secured environment. In many situations you’re not allowed to create additional namespaces, and sometimes everything has to be deployed in a single namespace.