possibility to limit down the rootCA on a specific domain

we use this for our test-environments (QA testing) and distribute the certificate across the engineering team. they have to import the rootCA in order to be able to have ssl working on our test environments.
However, having a rootCA that's valid for the whole internet allows for MITM attacks within our company network (or any other an attacker has control which we would use).

In order to mitigate this, i want to limit down the rootCA to one domain only (*.our-test-company.co). Does `mkcert -install` provide any options on this or shall i generate my own rootCA, limited on domain, which i then place into the rootCA path?