Application Control for Business in Intune has built-in controls and XML upload of WDAC policies and now supports targeting Managed Installer to specific groups instead of the entire tenant.
GA date: August CY2025