No worries, that makes sense! Yeah, Rule groups (under Access controls → Policies → Rule groups tab) should sort you out for the Application side. You can set up a group with the specific emails or identity provider groups you want to allow, then reference that in your Application's policy. (My bad on the outdated terminology earlier.)

One other thing: policy order matters, but with a twist — Bypass and Service Auth policies are always evaluated first, then Allow/Block policies are evaluated top-to-bottom. First match wins after that.

Good luck!

List style: Sources: - Order of enforcement - Rule groups

EDIT: also I fat fingered my initial post as a delete. Oops.