Why do I need Global Secure Access client when I'm already using a CAP to only allow sign-ins to 365 from azure-joined PCs OR network locations already?

Question

https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-get-started-with-global-secure-access

https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network#enable-global-secure-access-signaling-for-conditional-access

I'm already using a conditional access policy to restrict only azure-joined pcs to be able to sign in to 365 or unmanaged servers from a trusted location. How is installing a Global Secure Access client going to help or be different? I don't understand the point if i am already achieving this?