Need access outside the internal network to one drive for business for members of a group.

So right now we have an Exchange Online conditional access policy (covers everyone), allowing our in-network users to use the product without MFA, and requiring MFA for off-network access.

What we need is a Sharepoint Online conditional access policy (covers everyone), allowing full access with syncing for our in-network access, and only allowing the off-network edit-mode access for the opt-in group. So anyone in the opt in group would have sharepoint access off-network. 

is this doable? 

thanks