To limit access to the CyberArk Identity user portal to only corporate issued domain-joined laptops without the use of a VPN, you should use the Windows Cloud Agent and CyberArk Identity Connector with Integrated Windows Authentication (IWA). This setup ensures that only devices within the organization's domain, specifically domain-joined laptops, can access the portal since IWA verifies the identity of the user through their domain credentials without needing a VPN.