How to restrict Microsoft Office 365 business users to sign-on at work location only?

You can use for this purpose Microsoft Entra Conditional Access. Create a Conditional Access policy that targets the users you want to restrict and the Microsoft 365 cloud apps you want to protect, then use the Conditions > Device platforms and Filter for devices controls to distinguish corporate devices from personal devices. You can require that access come only from compliant devices that are enrolled and managed by Microsoft Intune. The policy can then grant access only when the device is marked compliant. A personal Windows, macOS, iOS, or Android device that is not enrolled and compliant will be blocked from signing in.

For company-owned Windows devices, you can use Microsoft Entra joined or hybrid Microsoft Entra joined devices together with Intune compliance policies. For mobile devices, require Intune enrollment and compliance before allowing Microsoft 365 access. Conditional Access can therefore enforce a rule such as "Microsoft 365 access is allowed only from an organization-managed, compliant device." This is considerably stronger than trying to restrict access based solely on the user's physical work location, because a user could otherwise authenticate from a personal device while physically sitting at the office.

If by "work location only" you literally mean users should be unable to sign in when they are outside the company's physical office, Conditional Access can also use Named locations based on the organization's public IP addresses. You could create a policy that blocks access unless the sign-in originates from the company's office IP ranges. However, this does not prevent personal devices from accessing Microsoft 365 while they are connected to the corporate network. To accomplish both objectives, use two controls: require a managed/compliant device and restrict access to the organization's trusted network locations. Be aware that this will also prevent legitimate remote work unless you provide an approved remote-access mechanism such as a corporate VPN whose public egress IP is included in the trusted location.

For Microsoft 365 specifically, you should also consider Exchange Online and SharePoint/OneDrive separately depending on what you are trying to protect. Conditional Access can protect Microsoft 365 cloud applications broadly, while SharePoint and OneDrive unmanaged-device policies can provide additional controls such as blocking access or allowing browser-only access from unmanaged devices. If your requirement is simply "no personal devices can access company Microsoft 365 data", the cleanest design is generally Intune enrollment + compliance + Conditional Access requiring a compliant device, rather than relying on IP/location restrictions alone.
Note that Microsoft Entra Conditional Access requires Microsoft Entra ID P1 or P2, which is included with licenses such as Microsoft 365 Business Premium, Microsoft 365 E3/E5, Office 365 E3/E5 plus the appropriate Entra ID license, and Enterprise Mobility + Security E3/E5. If you want to require devices to be Intune-compliant, you also need Microsoft Intune licensing, which is included in Microsoft 365 Business Premium and several enterprise suites. For a business that wants to prevent Microsoft 365 access from personal laptops, desktops, and phones, Microsoft 365 Business Premium is a straightforward licensing option because it provides Entra ID P1, Intune, and the necessary Conditional Access and device-compliance capabilities. If the requirement is also to restrict access to the physical workplace network, Entra ID P1 Conditional Access can additionally use trusted Named Locations based on the organization's public IP addresses.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin