have an app service that I want to close down to ALL public access. They can neither read nor write.

If you’re apart of the companies Entra compliant devices I want to allow them to make inbound and outbound requests.
But at the same time I need to allow services from our virtual network to access the services.
E.g.
I have a service Bus topic that delivers messages to my API (this should be allowed)
I have an Entra ID user that through an website that makes a GET request (this should be allowed)
There’s an user that is NOT on a Entra compliant device that makes a GET request (this should NOT be allowed)

In short:
Is there a way to lock down our services, doesn’t matter if they’re API’s, websites or what have you.
it’s very important to me that they have to have MFA setup, in the same way that you can lock down teams to not allow you access unless you’re on a compliant devices like so:

So far I have looking at using Entra to use conditional access policies, but in my mind that breaks the requirement of the individual services being able to talk to each other.

I have also looked at app proxy but that wouldn’t work because we’re moving away from an onprem infrastructure.