Not allow users to join personal device to Intune

Hi, 

We want to allow user to join work device to Intune by going to work or school account and registering the device to AAD and then signing in with their work email id by switching to other user. However we don't want users to do the same on their personal device. We can check their devices on Intune after they have joined it but we don't even want the joining to happen, like prevention at best. 
I looked at a few settings but wanted to know if there is any recommendation .
1) First thing we could do would be to limit the no of devices the users can enroll to 1 
2) Other way i was thinking was we could add the serial number of devices to be counted as corp device but this won't be a good idea once the company grows big