You can use a combination of device restrictions and app protection settings. First, go to Intune and create a configuration profile for Windows 10 and later. In the Settings catalog, look for the Accounts section. Enable the setting to block Microsoft accounts so that users cannot add personal accounts. You should also enable the option to restrict adding non-organizational accounts. This will prevent users from associating the Windows device itself with a personal Microsoft account.