The many ways to block automatic email forwarding in Exchange Online

Hi Alana. Good article but we have a unique situation where these options didn't work for us when I looked a few months ago. We have ExO mailboxes that auto-forward to a few on-prem mailboxes and we also utilize centralized transport so all inbound/outbound email flows through our on-Prem. When I set the default remote domain to prevent auto-forwarding in O365, those legitimate auto-forwards to on-Prem wouldn't arrive. I tried the Transport rule to allow auto-forwards to our on-Prem mailboxes but nowhere else but never got them to work. One option would be to get all the on-prem domains that it could auto-forward to and set remote domains for those with auto-forward allowed but there's the potential these could change over time. Any suggestions to allow all auto-forward to our on-prem mailboxes but not from on-prem to the internet? We already have the * remote domain on-prem set to not auto-forward but if people set auto-forwards in the cloud, they bypass that when it routes through on-Prem. Thanks.