First off, I apologize for resurrecting such an old question. However, according to Microsoft, this is now possible with a feature inside of Azure AD called tenant restrictions. Here is an excerpt from the Microsoft Doc, linked below:
Large organizations that emphasize security want to move to cloud
services like Microsoft 365, but need to know that their users only
can access approved resources. Traditionally, companies restrict
domain names or IP addresses when they want to manage access. This
approach fails in a world where software as a service (or SaaS) apps
are hosted in a public cloud, running on shared domain names like
outlook.office.com and login.microsoftonline.com. Blocking these
addresses would keep users from accessing Outlook on the web entirely,
instead of merely restricting them to approved identities and
resources.
The Azure Active Directory (Azure AD) solution to this challenge is a
feature called tenant restrictions. With tenant restrictions,
organizations can control access to SaaS cloud applications, based on
the Azure AD tenant the applications use for single sign-on. For
example, you may want to allow access to your organization's Microsoft
365 applications, while preventing access to other organizations'
instances of these same applications.
With tenant restrictions, organizations can specify the list of
tenants that their users are permitted to access. Azure AD then only
grants access to these permitted tenants.
I started doing research on this subject today as I was facing the exact same quandary. A client requested this specific feature be enabled on his Azure AD and I was not sure if it was possible. Thankfully Microsoft finally (6+ years after the original question above was stated) has a solution documented for this issue:
Use tenant restrictions to manage access to SaaS cloud applications
I'm planning on implementing this solution over the next few days and I will report back in the comments to this answer if it is indeed exactly what I (and the original question) was looking for.