greatquux, I recommend not using Windows Server IIS for your SMTP needs, as it's not a supported solution for sending email to Exchange Online (https://learn.microsoft.com/en-us/previous-versions/aspnet/8b83ac7t(v=vs.100)). Have you seen the announcements on this blog about High Volume Email for Microsoft 365? Even if your client's copiers/scanners are not sending high volumes of email, it (or depending on where your recipients are, Azure Communications Services for Email) could allow you to move SMTP to the cloud.
As for your management needs, the underlying question is why are your clients still using Active Directory for identity management instead of Entra ID?