The way I handle this is if you want a specific device to have those settings regardless of what users are logged into it you use device groups. The other side of this is if you want the settings to follow the user regardless of what the device is they are using assign to a user group.
An example of this would be using a shared device that you want to harden more than assigned devices you would create the restriction/compliance policies and target your shared devices.
