You can't prevent it in the service, but you can force devices to enroll and accept defined policies.
With the native O365 MDM rules, you can require devices be enrolled before accessing services. Create a new MDM policy and apply it to a test group, assign a test user. Now any supported device that uses an app to login with an ID in that test group should trigger a request to enroll that device.
Technically, I think you could do this (block an app) with ADFS and be checking something like User-Agent string, but I think services like Okta or OneLogin can help with that specific scenario without having to craft special rules. I would expect it to come with a lot of overhead in keeping up with it, and a high likelihood of unintended consequences, like breaking apps you didn't intend to.