Block all internet connection for Intune device but accept only some exception

Hello!

We would use the Windows firewall to block access to internet for Citrix laptop. We want only allow Teamviewer, Citrix, Intune, Windows Update,.. 

Is it possible to reach this goal? 

I tested Windows Defender (Endpoint Admin Console) but it seems we can only block site by site.... 

Thank you !