What’s replaced Intune & Intune Enrollment for new CA policies?

I am trying to restrict access for personally enrolled IOS devices to only use MAM.

It’s been a while since I worked in delivery, but I believe it used to be best practice to incl. all Cloud Apps and then exclude Intune and Intune Enrollment.

With the new CA policies there is now resources rather than cloud apps and there’s a bunch listed under Intune, some under Microsoft Device Management or App Management, and I’m not sure which I should be excluding now?

What I actually want to do is block access on iOS devices to everything but Outlook and Teams, and then apply MAM to them, so if there’s a better way to achieve this please let me know.

Bonus points if I can require MFA for enrollment?