We are using access only for VDI access.

I guess we have to move to intune and decom workspace one.  The ability to restrict email to enrolled devices is a pretty basic requirement.  I'm surprised this isn't more common.