With allowed SAN lists, you can limit the subject alternative names that subordinate issuing authorities can use when issuing end-user certificates.

See Creating an issuing subordinate authority for how to assign a SAN list to an authority.