You can disable MDM enrollment of personal devices by using the Device Type Restrictions under:
Microsoft Intune > Device enrollment - Enrollment restrictions > All Users - Properties > Configure platforms and set the individual platforms to Block
This ends up that you are able to enroll into MAM as this is an AAD register of the device and not a MDM enrollment. As soon as an user tries to enroll via MDM (Company Portal) the action is blocked though this setting. A MDM enrollment would still be possible if the device will be registered before with Serial Number or IMEI under Corporate device identifiers.