Restrict Enrollment to Registered Devices Only
Regardless of whether administrators or end users register devices (or whether you skip registration in favor of registration tokens), you can restrict the enrollment to only registered devices.
Navigate to Devices > Device Settings > Devices & Users > General > Enrollment and select Registered Devices Only.
With this option enabled, only devices that have undergone the registration process are allowed to enroll into Workspace ONE ™ UEM. Devices that are not registered cannot enroll.