That's what Mail contacts are for: https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-mail-contacts
Security-wise, there's nothing to be concerned about here, you are simply creating a "placeholder" for a given address. It's not an actual user, it cannot be used to access any resources or expose company data.