jkg11, if you're identities are largely authoritative on-premises (syncing to the tenant via AADC), the recommended approach is to setup an Exchange management server to support provisioning mail-enabled users, contacts and even remote mailboxes. Alternatively, there are other approaches that could be used where you manually manipulate AD-DS attributes for each identity created on prem so that the recipient types are setup correctly to be identified by ExO and MEUs, but when you go down that route, you run in to potential supportability issues. If you don't have a management server, you may need to extend the AD-DS schema so that exchange attributes are available.
With an Exchange management server on-prem, you would be able to run new-mailuser on prem. Doing that would sync the identity via AADC as a mail enabled user (MEU) to the tenant