Need BYOD configuration advice for all platforms

Hi everyone,

I'm somewhat new to Intune and currently browsing through a lot of the documentation to try and provide a solution for a small business. The business wants to collaborate with several free lancers, who will be using their own devices to access company resources like SharePoint and emails. I need a way to restrict BYOD devices to only be able to sign into dedicated apps that the company have control over (can wipe remotely), but without fully joining their devices and giving the company more control than required.

Scope: 25 Microsoft Business Premium users with Corporate owned computers and BYOD mobiles. 20 Microsoft Basic users with BYOD computers and mobiles. Most computers are Mac.

My current solution for mobile devices is to have a mobile device policy that sets Outlook for IOS and Android to quarantine (for approval), and all other platforms to block automatically. I've also added a App Protection Policy to ensure a separate PIN is required to unlock Outlook. Haven't found a solution for restricting SharePoint app yet.

For PC, I was hoping to set up Company Portal for the devices to log into and view Outlook and SharePoint, but I can't figure out a way to restrict the BYOD user from logging into Outlook with their business email outside of Company Portal. Is there even a functionality where we can create a separate space on a personal computer with Company Portal, and only allow company data to be stored there, blocked elsewhere?

I've also been trying to read up on Macs for this and might trial Jamf to see if I can place these restrictions without causing an invasion of privacy for BYOD users.

Apologies if any of the above are repeated questions, please direct me to the answers if that's the case. Thanks in advance.