Block Microsoft 365 account from logging on Windows machine?

Hello! How can I block a user from logging on Windows with Azure AD on our machines, but still allow it to use Microsoft 365?

Basically we have a service account that should only be accessed from iOS MDM devices by default.
A way to exempt some Windows machines would be nice, but the preference is ban the account from Windows logon altogether. 

We use Microsoft 365 with Intune. All machines are managed.

Thanks in advance!