Can you also block iPhones with this method and how would I go about doing that?

They don't want any of their users to use a phone to login so it would be company wide. They have a dedicated connection server so that's not an issue either.

I can look at the ADMX options. Thanks.