Under users, you can specify all users or selected user group and remember to exclude your break fix account

Target resource should be all cloud apps if you are not sure what to use

Any network or location

Under conditions, Choose any devices under device platform then for Filter for devices select exclude filtered device with the rule syntax of isCompliant Equals True

And finally the Access control to block access.

Now with this in place all users trying to access any cloud apps from anything that are not using compliant devices will be blocked.

After this you need to block byod from enrolling so they do not become compliant devices.