Can I refuse devices that Intune says are not compliant?

Yes. It's set per client, with two options: ignore Intune's verdict, or refuse a device that isn't compliant. It's only shown for clients set up with Entra ID and Intune. A client on another MDM has no Intune verdict to read.

Ignore still records the verdict. Passbeam reads Intune's verdict where it can and logs it with each authentication, so you can see what refusing would have done before you turn it on.

It starts set to ignore. Turning it on can stop people connecting who were connected five minutes earlier, so it's the client's decision.

Two limits. It only works with a device certificate, because a user certificate has no device to look up. And if Intune can't give an answer, Passbeam uses the last verdict if it's less than a day old. If there isn't one, or Intune has never checked the device, the device is let on and the log says why. A certificate that can't be verified is always refused.