You can restrict access for devices that aren't marked compliant via InTune. You will need an Azure AD Premium subscription to configure restriction here. Conditional access policies are outside the scope of the MS-300 exam.
For more information on InTune and Conditional Access Policies, please see https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview.
The available options are as follows:
- Allow full access from desktop apps, mobile apps, and the web.
- Allow limited, web-only access.
- Block access.
Selecting either Allow limited, web-only access or Block access will change the setting for Apps that don't use modern authentication to Block since modern authentication is required to enforce device-level policies.