Intune iOS User-Based App Targeting

I’ve noticed an issue with user-based targeting and was wondering if this is an issue, or I'm just using it wrong.

Lets say I want an iOS app to be deployed out to a user group, but only to company owned devices of those users. I set the assignment for required user group and assign an Include filter for corporate owned devices. If this app is also Available for All Users, then the app deploys out to all devices from the required user group, even their personal devices. It basically forgets there is a filter for the required user group assignment.

Any way around this? It feels like a glitch in how Intune deploys apps.