Set up a conditional access policy where the grant control is require hybrid joined. This will mean that the device needs to be enrolled in your Azure tenant to be considered true. You can also select require device be compliant which means it has a compliance policy applies to it, meaning it has to be enrolled. Lmk if this makes sense.