Condicional Access only use Partner Center

I'm a CSP partner admin and I need to restrict a specific group of ~50-60 users so they can ONLY access Partner Center, while all other Office 365 and Azure workloads are blocked for them.

What I want to achieve:

• Target group: a specific security group of users
• Blocked: all Office 365 services (Exchange Online, SharePoint, Teams, OneDrive) and Azure management (Azure portal, ARM, Az CLI/PowerShell)
• Must keep working: Partner Center (partner.microsoft.com) sign-in and normal usage

What I've tried:

I created a Conditional Access policy with:

• Users: the target security group (break-glass accounts excluded)
• Target resources > Cloud apps > Include: "Office 365" and "Microsoft Azure Management"
• Grant: Block access
• Started in report-only, then enabled

The problem:

This is not producing the result I expected — [describe exactly what happens here: e.g., "Partner Center access is also being blocked" OR "the Office 365 / Azure block is not taking effect" OR the specific error/AADSTS code the user sees].

Questions:

1. What is the correct way to scope a CA policy so Office 365 and Azure are blocked but Partner Center sign-in continues to work?
2. Which cloud app / service principal does Partner Center (partner.microsoft.com) authenticate against, and does blocking "Office 365" or "Microsoft Azure Management" indirectly affect it?
3. Is the recommended pattern "block only Office 365 + Azure Management" or "block All cloud apps and exclude the Partner Center app(s)"? If the latter, which exact app IDs should be excluded?
4. Does Microsoft Graph need to remain unblocked for Partner Center to function, and if so how should that be handled in the policy?

Environment:

• Tenant type: CSP partner tenant (partner.microsoft.com enrolled)
• Entra ID license: [P1 / P2]
• Policy state: [report-only / on]

Any guidance on the correct cloud app scoping would be appreciated. Thank you.