Hi @ xhope,
You can install the IP and Domain Restriction Role and restrict external access to OWA or MAPI through IIS configuration.
For detailed instructions, you can refer to the article below:
Disable external access to ECP in Exchange Server
(Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)
In addition, if you have a firewall configured in your environment, you can check if it supports blocking traffic entering the specified link (for example: https://mail.contoso.com/owa)?
This method can also prevent users from external accessing OWA or MAPI.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.