1.1 Create an ITP policy.
1.2 Is SCIM enabled in your org?
If yes, then directly assign users to your ITP policy.
If not, then instruct end users to log into the CSE app and register their devices; Afterward, assign your end users to the policy.
2.1 On the Managing Internet Threat Protection Policies doc, navigate to the Exclude Users from ITP Policies section to learn how to exclude specific users in your org from the ITP policy.