Intune optional user IOS app install

[greenporcupine]

 

 

Hi,

I have been trying to figure out how a user can selectively install apps on ios device via the company portal. I am using intune, and have Apple School manager VPP token all setup. 
When trying to assign apps as 'Available for enrolled devices' via a security group, the only license type is 'Device license' and not 'user license', and is not selectable when selecting deployment options. 
If I remove the group and select "All users" (which I don't want all users to have the option to install) I can select the license type. 
Not sure how I can enable users to be able to install a specific iOS app themselves if they choose to on their corporate Apple device. 
Any help I would be grateful.