You can now decide how machines join your workspace. In Settings, the Enrollment card in the Fleet section has a switch that requires an install token for every new machine, and a limit on how many install tokens can be live at the same time, shown beside the number live today.
The policy is off until an admin turns it on. Machines that are already enrolled keep reporting after you turn it on, so the switch does not cut off your existing fleet. Only admins can change the policy, each change is recorded in the audit log, and other members see it read-only.