Application and Device control SEP

Hi all,

I wonder if it would be possible to create a application rule set that is set so you can only start RDP / MSTSC from a laptop.
We have a project where some laptops will function as a thin client that only needs to connect to a Terminal server, all other applications can be blocked.
People will work from home, so a normal AD policy is not really an option.

Anyone here that has experience in creating a application rule set, that block everything except application X?

Thanks,

LEVD