DMARC & On-Prem Distribution Lists

Question

We are working towards switching our company domain's DMARC record from p=none to p=reject, and have Exchange On-Prem (2016) and Exchange Online Protection as our front end SMTP gateway. One of our bigger concerns is how p=reject will affect On-Prem distribution groups with external contacts as members. It's my understanding that this could cause DMARC to fail when an external member replies to the group and others receive this reply externally - it will have a Header From of johndoe@externalsender.com and an Envelope From of InternalDomain.com and cause such messages to be considered spoofing attempts by most spam filters, causing messages to be rejected or quarantined due to lack of alignment even though the messages are DKIM signed. We therefore are concerned we may see widespread complaints once we switch over.

I've seen some discussion of a few ways of mitigating this - one being ARC (which is being implemented via EOP this year - https://m365admin.handsontek.net/microsoft-defender-for-office-365-exchange-online-protection-customizable-authenticated-received-chain-arc-configuration/) but that may not help us given our mailboxes and groups are hosted on-prem. Another possibility is header rewriting via our Edge servers (https://learn.microsoft.com/en-us/exchange/architecture/edge-transport-servers/address-rewriting?view=exchserver-2019), which would be great if we could only target external replies to DLs. Finally, a third costlier option would be switching our DLs to an external ListServ provider that is DMARC compliant - something we could certainly consider if that ends up being our best option.

Has this issue been mitigated in any other fashion I'm not aware of? What have others done to avoid this pain point? I imagine this would be affecting lots of companies as more and more spam filters put an emphasis on DMARC passing.