How about restricting Access by IP range?

1. Go to organization settings → security → IP restrictions
2. Add allowed corporate IP addresses
3. Block all other external IP addresses

... or use restricted git authentication via PAT policies:

1. Go to organization settings → security -> policies
2. Under "Personal Access Tokens", disable PAT usage
3. Under git Credential manager", require azure AD authentication

Problem is that PATs are easy to misuse, and I see PATs getting misused a LOT of times.