At the moment, the mobile app policy gives the customers two options:

• Apply it for all users in the organization (recommended)
• Apply it for a subset of managed users:

The first option encompasses all managed users + all external users that the organization has (confirmed by our Mobile app policy documentation):

It would be really nice to provide the organization admins with another option to enforce the policy only on all managed users instead of encompassing all managed and external users in the first option.

Workaround:

At the moment, if the customer wants to enforce the policy only to managed users, the only workaround is to manually add the managed users using the second option.