Blocking devices from accessing network without vpn

How are you allowing access to your network that is not via IPSEC or SSL VPN? And what do you mean "other than our domain network"? Do you have a DMZ set up for public-facing servers? (And what kind of public-facing servers are you using?)

What i meant is that some users take work devices outside the organization and connect to other networks, if they need to access the org resources they have to vpn, but my concern is on the data which is already on the laptop or if any kind of threat that can be transmitted after they connect to our network when they are back to office. The last attack attempt happened when the user was connected from their home network. Hope i explained the situation properly. 

Hello Reem Jalal Eddine ,

As they need to connect to the VPN to access the resources of your local network. It is advisable to have endpoints installed to secure transmission. 

We can control incoming connection for the VPN establishment by allowing specific network range in Local ACL. However, as the end user IP changes they are likely to be updated in the firewall else they will not be able to connect VPN.