@Michael Cleverdon Currently Azure AD conditional access only allow the Sharepoint Site to have have a granual controls per page. With other cloud apps that is not possible to have different control set with different pages.
You might convert that Web app into 2 set of cloud apps that means different application ID and controls. That way you can target the restricted one to only a single device using Device filter option in Azure AD conditional access. Hope someone in community might have another way/idea.
-----------------------------------------------------------------------------------------------------------------
Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.