How do you handle approved personal device usage without opening the floodgates?

Your approach is fundamentally sound. The overcomplication risk is real, but it stems from trying to bolt this onto an existing internal user policy set. My recommendation is to build a completely separate, dedicated policy chain for contractor BYOD from the start.

For policy structure, I use a hierarchy: a top-layer rule with the contractor User-ID group that does nothing but route traffic to a specific VSYS or virtual system if your architecture supports it. This creates a clean administrative boundary. Then, within that container, you build your app-based allow policies, sourced from the Prisma Access tunnel interface and destined to the explicit internal app IPs. The key pitfall in scaled registration isn't the PANOS side, it's the service desk process for issuing the HIP-check exceptions. You need a hardened, auditable workflow there, or it becomes the weakest link.

To prevent pivoting, app-based policies are your primary control, but you must combine them with a default deny rule in that contractor policy set that also denies all intra-tunnel traffic. This stops them from using the VPN connection as a hop point to reach other systems, even if they find a way to enumerate them. Continuous verification is good, but set the HIP check interval aggressively and tie it to a short client certificate validity period for an extra layer.