@tartor321 Thanks for posting in our Q&A.
If you want to use conditional access policy, the MacOS device don't need to enroll to intune. We can set up app-based conditional access policy.
https://learn.microsoft.com/en-us/mem/intune/protect/app-based-conditional-access-intune-create
To clarify this issue, what did you mean "specific MacOS devices"? Based on my understanding, there is a feature called "Filter for devices" in a conditional access policy that can filter the devices you want. However, this feature works on devices that are enrolled to intune.
Thanks for your understanding.
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.