It looks like there were two problems:
1) I am using Landesk 2016.3 SU1 and there is apparently a known defect relating to duplicate device creation that is fixed in SU3 for 2016.3. I installed SU4 and provisioning a device as before and no more duplicates.
2) The baremetal device was still present after provisioning but this seems to get deleted overnight when database maintenance runs. It only happens when provisioning bare metal with serial number as the identifier.
In short, the fix was to upgrade to 2016.3 SU4 and either use MAC address to provision or just let the core clean up the old baremetal devices a day after they are provisioned.