1. Install combination firmware (I used FA70_G955FXXU1AQD1). Once the phone boots up in factory firmware, you will notice that the "USB Debugging" is On but "OEM Unlock" option is missing. Don't worry, we will fix that later.
2. Install RLC.apk v1.1.15 from PC (adb install Rlc.apk)
3. Install Ice Box v188.8.131.52 from PC (adb install com.catchingnow.icebox-184.108.40.206-G-varies-sdk21-vc593.apk)
4. Since we do not have Root permission, set Ice Box as a Device Administrator from PC (adb shell dpm set-device-owner com.catchingnow.icebox/.receiver.DPMReceiver)
5. Restart the phone
6. Open up Ice Box, continue as Device Admin and in the APPS section, "Freeze" the RLC package (Title: Notification, Description: com.samsung.android.rlc). You may need to enable the "Include Hidden" option in Ice Box from the top right corner.
7. Now that RLC is frozen, install stock firmware with "HOME_CSC" so that the two apps we installed do not get erased. I used "AP_G955FXXU1AQH3", "BL_G955FXXU1AQH3", "CP_G955FXXU1AQH3" and "HOME_CSC_OWA_G955FOWA1AQH3" from the Telcel firmware.
8. We are done, remember to keep RLC package frozen.
After step 7, I changed the language to English from Settings and also disabled OEM Lock from "Developer Options". A few observations at this point:
1. The phone is still RMM locked, we have only suppressed the SEM_LOGISTICS PIN Code prompt. You can see "RMM State: Locked" in download mode. Also, if you go to Settings->About Phone->Status, you will notice "Installment payments" section marked as "Outstanding".
2. It is said that "RMM State: Prenormal" automatically goes away if you keep the phone up for 168 hours without rebooting. I do NOT know, if "RMM State: Locked" goes away automatically or not, but I doubt it.
3. Since the RMM state is locked, custom binaries still cannot be flashed for rooting.
4. For TWRP, I got error "custom binary(RECOVERY) Blocked due to remaining installment balance"
5. For Root kernel, I got "custom binary(BOOT) Blocked due to remaining installment balance"
6. Secure Folder could not be setup. I kept getting a KNOX related error but do not remember its text now.
7. I tried to backup the PERSISTENT partition but got Permission Denied error because I did not have root.
8. The command "dd if=/dev/block/platform/11120000.ufs/by-name/PERSISTENT of=/sdcard/PERSISTENT.img" failed.
9. The command "dd if=/dev/block/sda13 of=/sdcard/PERSISTENT.img" failed.
10. I tried to format the PERSISTENT partition but got Permission Denied error because I did not have root.
11. The command "dd if=/dev/zero of=/dev/block/platform/11120000.ufs/by-name/PERSISTENT" failed.
12. The command "dd if=/dev/zero of=/dev/block/sda13" failed.
13. KNOX was not tripped so phone warranty was not void.