Conditional Access App Control works by proxying user connections to cloud apps (provided Azure AD is used for authentication) through the MDCA service, and then monitoring connections and applying policies to user sessions in real time. Because connections are proxied, rather than direct to the app, the policies defined can control – at a granular level – the functionality delivered to the end user.
Keep in mind that app control only works for web sessions, so if you want to ensure your cloud apps are secured, you might want to block desktop and mobile apps or manage them by using Endpoint Manager or other means.
