This question combines two powerful security features: VPC Service Controls (VPC SC) for data exfiltration prevention and Context-Aware Access (CAA) for fine-grained user access based on context.
Contextual Requirement: Requiring a "company-managed device," "specific location," etc., is the function of Context-Aware Access (CAA), implemented via an Access Level.
Combining VPC SC and CAA: CAA policies can be integrated with VPC SC perimeters to enforce the context for access into the perimeter.
Evaluating Impact: To evaluate changes without blocking access, the entire VPC SC perimeter (including the new CAA rule) should be configured in dry run mode.
Extracts:
"Context-Aware Access (CAA) allows you to define and enforce granular access to Google Cloud resources based on user attributes like device security status, IP address (location), and identity." (Source 3.1)
"When implementing a new security policy... it is best practice to initially configure the VPC Service Controls perimeter (including any associated Access Levels/Context-Aware Access) in dry run mode. Dry run mode allows you to test the perimeter's effect on services without blocking any access." (Source 3.2)
"You can use an Access Level (the core component of CAA) to define the conditions for accessing resources protected by a Service Perimeter." (Source 3.3)