Best practices: Open OneDrive/SharePoint sharing but restrict Teams guest access by domain

Hi all,

Since SharePoint Online and OneDrive retired OTP-based external sharing in favor of Microsoft Entra B2B, we've run into a policy conflict and would like to hear how others are handling it.

Our requirements:

• Enable OneDrive/SharePoint file sharing with external users, even if their email domain is not on any allowlist (ad-hoc sharing with clients, partners, one-off recipients)
• Restrict Microsoft Teams guest membership to a defined list of approved partner domains
• Keep Teams external access (federated chat/meetings) working with external users from all domains

The problem:

Teams guests, SharePoint guests, and OneDrive guests all go through the same Microsoft Entra B2B invitation framework, governed by the single "Collaboration restrictions" domain allow/deny list under External Identities > External collaboration settings.

This means we can't set a stricter domain list for Teams guest / Entra ID invitations while keeping OneDrive/SharePoint sharing open to any domain, since it's the same policy for both. 

We confirmed this is expected/by-design behavior via Microsoft Q&A (Microsoft engineer's answer here: https://learn.microsoft.com/en-us/answers/questions/5954975/onedrive-external-sharing-no-longer-working-with-a)

Our current plan is to:

1. Set Collaboration restrictions to "Allow invitations to be sent to any domain"
2. Keep Teams External Access open to all domains (federation is separate from guest access, so this doesn't affect it)
3. Compensate for Teams guest access using a Conditional Access policy that blocks Microsoft Teams sign-in for guest accounts that are not members of a dynamic security group scoped to our approved partner domains, while leaving SharePoint/OneDrive untouched (CA policy target resource = Microsoft Teams only)

Before we implement this, we'd like to ask the community:

• Has anyone solved this differently, e.g., via Entra Entitlement Management / Access Packages with Connected Organizations, without needing to maintain a dynamic group?
• Are there any known limitations or edge cases with scoping a Conditional Access policy to "Microsoft Teams" specifically (vs. "Office 365" as a whole) that we should be aware of?
• Is there any roadmap item for per-workload domain restrictions within Collaboration restrictions (i.e., separate policies for Teams guest invitations vs. SharePoint/OneDrive guest invitations)?

Any real-world experience or best practices would be very much

appreciated.

Thanks!