Personal Device being asked to enroll when signing in via RDP.

Hi all

We have multiple contractors that we want to onboard W365, they would use their personal PC or Development House PC. 

We have multiple conditional access policies setup on Intune. 

We are struggling with some rule or setting that is forcing the contractor's personal device to enroll their personal device. We don't want to know about their device. We just want them to sign on to our W365 pc, and all conditions and policies applied to the cloud PC only.  

Can you please assist me in guiding me to the correct policy, setting or exclusion in MCAS, Intune, or AAD?

Thanks