How does one prevent direct access to an app from a chrome managed profile. I want them to be forced to come through the workspace app and then kicked over to a browser tab. I see it says allowed or denied depending on the secure private access config.