As nobody seems to be able to help, maybe somebody is interested to read what i found out.
AMP Setup > General > Automatic Authorization > Automatically Authorized Switch Mode: must be set to "Manage Read/Write"
But i still got no template provisioned because:
The "Template firmware version" must match the "Desired Version" in Groups > Firmware
This was wrong, the desired version has no effect. You only need to be patient and should not try to login and configure stuff on the Switch while you wait for the automatic stuff.
Now i also got the template config onto the switch!
But i do still have an issue, as the template amp-server configuration now overwrites my site specific settings from the DHCP server. How can i "conserve" this site specific amp-server settings?