Condition Access Questions - specific site collections

Hi 

I want to grant access for a group of users, IF they are logged on from a known/trusted location

I then want to grant them access to some specific Site Collections (that have an external add-in/app)

My first thought was create a Conditional access policy and chose the App/Add-in - but that doesn't work - so instead I can choose SPO as the APP - but that will effect all the other Site Collections where some are external sharing. 

Have someone "solved" similar problem? - and can provide the "steps" ?


"Remember to always be yourself. Unless you can be batman. Then always be batman."