The ATGM336H module defaults to 9600 baud for NMEA output and works standalone without an M5 host or init signal; it just needs power, antenna, and a clear sky view.
Per the pinout diagram, GNSS_TX routes to M-Bus pins 13, 15, 21, 23 (RX side, but TX signal), or 26 via DIP switches (labels like G3/G13/etc). You've tested the right pins; try setting all DIP switches ON simultaneously (safe standalone), connect to pin 13 at 9600 baud, and wait 1-23s for hot/cold start. b'\xff' might be noise if the antenna signal is weak.
Example code tweak: Use uart.any() and uart.readline() for cleaner NMEA capture. Doc's schematic confirms no enable needed.