VPN for Contractors

I am looking for some guidance here base on my situation/requirements.  I have a VPN access configured on our fortigate which services our corporate employees and is working fine as expected. I also have contractors where I don't want to allow them access in the existing VPN tunnel but instead create a more restricted tunnel where once they login, they can only reach specific subnet destinations on restricted TCP ports, but here is the kicker.. these contractors have personal laptops, and I want to know if I am leverage Intune to apply conditions access without forcing them to enrol their personal device to Intune. Let's confirm the firewall specifics question :) Thanks