G Suite customers have been asking for the ability to whitelist OAuth clients/scopes for their domains for years, for this exact reason. So far, Google hasn't really given a shit.

I guess that might finally change now.