Deploy app to compliant devices only

I'm probably missing something obvious, but I was wondering how I could deploy an app or configuration profile and limit it to compliant devices.  Conditional access obviously isn't the solution as i...