Guest account for AAD Devices

Hello Community,

I have the following problem: as I have just been informed, some of the employees sometimes make their notebooks available to the participants during a training course purely for research purposes on the Internet. This is done because there are no extra devices for this and the participants themselves do not have notebooks.

Now I have thought about how to realise this so that the participants could do research on the company devices without having access to the company network. I would simply set up a new group and withdraw access to all cloud apps from this group via conditional access.

Can I do this or should I take further precautions to ensure that these participants cannot access internal data under any circumstances?

Thank you very much