Need understand some point of this feature - 3.6. Managed configuration management

So you're backend will have to create on policy per device (or per user) and assign those policy accordingly to the correct device either based on the user or on the device. For each of those policy you would replace the wildcard by the actual value.