Does anyone know if it's possible to only allow VPN access to domain-joined computers only?

You can setup VPN from mikrotik to authenticate with user/pass from a RAS server (or whatever its called in new windows NPS? (i havent used this since old times))- but still radius in windows, and have the domain name and password as access to your pptp,l2tp etc. Setup almost just like a pppoe-radius server

The first question that comes to mind is why there would be both domain-joined hosts and non-domain-joined hosts on the same subnet. I try to avoid putting hosts at differing trust levels on a common subnet.