For devices that are MDE but not enrolled in Intune - you can use both the MDE portal and the Intune portal.
So for workgroup devices you can create policies for workgroup devices.
Learn about using Intune to manage Microsoft Defender settings on devices that aren't enrolled with Intune | Microsoft Learn