Blocking devices from accessing network without vpn

How are you allowing access to your network that is not via IPSEC or SSL VPN? And what do you mean "other than our domain network"? Do you have a DMZ set up for public-facing servers? (And what kind of public-facing servers are you using?)

What i meant is that some users take work devices outside the organization and connect to other networks, if they need to access the org resources they have to vpn, but my concern is on the data which is already on the laptop or if any kind of threat that can be transmitted after they connect to our network when they are back to office. The last attack attempt happened when the user was connected from their home network. Hope i explained the situation properly. 

What i meant is that some users take work devices outside the organization and connect to other networks, if they need to access the org resources they have to vpn, but my concern is on the data which is already on the laptop or if any kind of threat that can be transmitted after they connect to our network when they are back to office. The last attack attempt happened when the user was connected from their home network. Hope i explained the situation properly. 

Hello Reem Jalal Eddine ,

As they need to connect to the VPN to access the resources of your local network. It is advisable to have endpoints installed to secure transmission. 

We can control incoming connection for the VPN establishment by allowing specific network range in Local ACL. However, as the end user IP changes they are likely to be updated in the firewall else they will not be able to connect VPN.

These devices are owned by the company, correct? If so, you should look at things like Sophos' Intercept X endpoint software, which allow you to control user actions on the device and can scan for viruses, etc. You would need to make sure that the user does NOT have admin access: you control the admin login and the user gets a non-admin login. They may not like it, but that's too bad -- it's your device, not theirs. If the devices are their own, that's another matter., of course.

You manage Intercept X via Sophos Central (cloud). You can restrict things like usage of USB devices, what software can run, what websites can be accessed, etc, and can see activity reports.

I think you can use Intercept X to only allow connections to your domain (and anything that's needed to set up a VPN connection like Cloudflare DNS servers, etc).