We discovered that the 'Users may join devices to Azure AD' setting in our Azure AD was set to 'All' by default. At this point we have a number of users personal devices joined. Before switching it to 'None' I'm trying to get a feel for what, if any, impact changing it will have on the already enrolled devices.
This will not impact already registered devices. It will simply prevent new, unauthorized devices from being registered by users. You can safely turn it off.