How to protect Google Workspace apps while using Goolge Workspace as an iDP?

We currently use Google Workspace as our idP and have integrated it with Cloudflare Zero Trust.

Now that we want to start protecting Google Workspace apps, it seems we can’t put them behind access if we are using Google Workspace as our idP.

Is there another way we can protect Google Workspace apps without changing identity providers?

Ideally our users should only be able to access Workspace apps when their Warp client is on.

Anyone have any thoughts on how we can protect Google Workspace apps behind Cloudflare Access/ZeroTrust?