Conducted is easy enough, given that you aren't too picky about the precision of results, especially at high frequencies.
Traditionally, it ends at 30MHz on the dot. There's no reason you can't look further -- just the sanity of making that measurement at all, versus who knows what's evaporating off the cables or enclosure...
So, any time you can make a port-like measurement, it helps. For example, instead of measuring conducted emissions at a distance (after standard e.g. power cords and such), measure it at the enclosure -- assuming the enclosure is metallic so a good ground reference can be made there, and every connection exiting through that reference can be considered an RF port. (And if not grounded, then the nearest thing that can -- perhaps just floating the board over another ground plane and measuring all wires coming off the board.)
An open air test, boards laid out over a ground plane, is still susceptible to ambient fields, which you'll have to subtract from the measurement somehow -- hopefully they're below threshold so your measurement is still meaningful, and if not, good luck with the shielding budget -- but given that hurdle is passed, it's a good way to get some idea of the wideband emissions from individual boards, or equipment.
An adequate LISN can even be hand made (we have some excellent threads on that here), or they are easy to find for sale. Use the kind appropriate for your work of course; if your 12/24V DC equipment is like, automotive, look up the whatever standard is typically used for that; if it's more like uh, I suppose industrial kit would have to pass some relative of FCC Part 18, or the IEC/BS equivalent? Then, give that a look. (Although that might not be all that helpful as I think Part 18 is mostly OAT anyway, who needs LISNs?)
Also add CDNs for stuff like telecom pairs, etc. YMMV, may not be the easiest thing for like CAN bus, since it's DC coupled -- Ethernet and some RS-485 can go through transformer coupled CDNs which is nice, when it can't you have to use an attenuating (resistor coupled) CDN so keep that in mind.
I don't know what the MDO3000 spec option is like; if it's basically like any other spec, useful dynamic range, all the RBW settings and stuff, that's fine. If it has quasi-peak (QP) detection that's even better, but you can do precomp just fine with peak, too. I'd just be weary of anything that's just a regular scope with FT, those tend to have poor dynamic range, no spectrum averaging, variously no frequency offset or detector or RBW options, etc...
Yeah, current probes aren't a bad idea, but be mindful of where those currents are going -- or not. Some stuff laid out over ground plane, will just have whatever resonances between the stuff, and not much resonance towards the LISN(s) since those are resistive terminated. Resonances on cables and equipment are pretty easy to spot: keep an eye out for peaks/valleys, and what physical lengths those frequencies correspond to.
A couple 10-20dB wideband preamps, good idea. Attenuators too. Sometimes you want to use both simultaneously, just to have the safety padding, or freedom from reflections, and then claw back whatever SNR you have left since the spec probably doesn't have the greatest SNR (or rather, noise factor).
Near field probes, seconded. Not really meaningful in terms of relation to radiated emissions -- they're more for tracking down culprits, and then you can decide what to do with it (improved routing, bypassing, ferrite beads, shielding, etc.).
Yeah, ESD is a good tool, both for causing the upsets it's famous for, as well as a source of wideband RF. The low duty cycle makes it not a great substitute for the modulated CW used in immunity testing, but if you can deal with that (perhaps with an impulse or error detector on suspect circuits?) you can get some idea of general susceptibility too.
Tim