Block Mobile/Desktop app and extensions (only web vault access)

The ability to restrict all users or individual users from logging into anything but the web vault.

For example I don’t want some users to have a cached vault on their ios device/laptop etc.

OR (This is ideal)

The ability to set all users or individual users access via the apps/extensions for a set period of time and after the expiration it will force log them out instead of locking the app which clears the cached vault and they will need access to our on prem server to re-authenticate. For example if an employee is fired and I remove their access to the server they will not be able to re-authenticate and therefore not have access to the vault.
This is available for individual users however they have the ability to change these options themselves via the apps.