The elephant in the room here is that disabling Basic Authentication for Exchange ActiveSync will break almost every Android phone connecting to Office 365 that is using the native Mail app - with the exception of Samsung devices, which support modern authentication.
'Finally, we’ll address Exchange ActiveSync. As we have said previously, many up to date versions of mobile device email clients support Modern Auth already. Take a look at the usage report for your tenant and you’ll find the users on devices not using Modern Auth. The User Agent string will hopefully tell you the version of the device they are using.'
Switching to Outlook won't be a popular answer (but to be honest, this is really Google's fault, not Microsoft's).