Through Client configuration under devices you should be able to provide this access per groups/OU.

If you're sync'ing groups/OU from your IDP, you can target a client configuration to a group.
One thing to remember though, it that the client configs are processed first-match; the rest of your targeted client config needs to match your expected default.
 

Hi @farhan , I hope you got the answer what you're looking for. The solutions that were posted here might be helpful if you want to take a look. Feel free to click "Accept as Solution" on the response that worked for you. 😁

Good Day @farhan.. The best way to do this is go into Settings, Security Cloud Platform and then select Devices.  In the upper right part of your window go to Client Configurations.  Select "New Client Configurations". Here you can configure how the client will behave based on specified user groups.  The option to allow them to Disable the client is under Tamperproof.  You will want to check "Allow disabling of Clients".   Make sure to not have "Hide Client Icon on System Tray" as the users won't be able to disable the client if they are unable to access it from the system tray or menu bar on the Mac.