just confirming our chat @ross, it can be done with Shared drive restrictions, some info
here<SharedDriveRestrictionsFieldName> ::=
adminmanagedrestrictions|
copyrequireswriterpermission|
domainusersonly|
teammembersonly
for example, gam update teamdrive <shareddriveid> domainusersonly true
link here:
Update Shared Drive ... it just so happens that other three alternatives to copyrequireswriterpermission aren't in the example
thank you Ross!