Hi Marek,
Hope you are doing well.
Below link talks about Implementing Tenant Restrictions for Microsoft Office 365:-
This solely is not avaialble through policy creation in cloud .
In order to achive this you will need to use web hybrid setup wherein policies from on prem MWG will be synced to cloud.
This granular policy creation for tenant restrictions using header modifications is possible in on prem MWG but not solely on cloud.
Regards
Alok Sarda