Enable authentication via the Google Authenticator is the only secure option since USB device aren't usable. Google Authenticator is the most secure option after physical key.

* Navigate to the Google Admin console at admin.google.com.
* From the Admin console Home page, go to "Security" and then to "API controls."
* In the "API controls" section, click on "Manage Third-Party App Access."
* Here, you can add the OAuth Client ID of your internal app to the trusted list. This ensures that only apps you have vetted and approved can access Google Drive APIs, complying with your security policy.
* Enter the OAuth Client ID of the new app and save the changes.
This process ensures that the new, internal, domain-owned app can access Google Drive APIs without compromising the security policies in place.
References:
* Google Workspace Admin Help - Manage API client access

Login audit log Track user sign-in activity You can use the Login audit log to track user sign-ins to your domain. You can review all sign-ins from web browsers. If a user signs in from an email client or a non-browser application, you can only review reports of suspicious attempts. Forward log event data to the Google Cloud Platform You can opt in to share the log event data with Google Cloud Platform. If you turn on sharing, data is forwarded to Cloud Logging, where you can query and view your logs, and control how you route and store your logs https://support.google.com/a/answer/4580120?hl=en

* Install GCPW on Windows Devices:
* Download the Google Credential Provider for Windows (GCPW) from Google's official site.
* Install GCPW on each Windows device.
* Configure GCPW to allow users to sign in using their Google Workspace credentials.
* Enable Windows Device Management:
* Go to admin.google.com and sign in with your admin account.
* Navigate to Devices > Mobile & endpoints > Settings > Windows settings.
* Enable Windows device management to allow Google Workspace to manage the Windows 10 devices.
* Configure Settings and Policies:
* Apply necessary device policies and settings through the Admin console to ensure security and compliance.
* User Login:
* Users can now use their Google Workspace credentials to log into their Windows 10 devices, and the devices will be managed via Google Workspace endpoint management.
This setup integrates Windows 10 devices with Google Workspace for unified credential management and device policy enforcement.
References
* Set up Google Credential Provider for Windows (GCPW)
* Set up and manage Windows devices