Emails from Azure Communication Services (ACS) are treated as external emails

When using Azure Communication Services (ACS) Email, messages are delivered to Microsoft 365 as external mail, even if the system sending them belongs to my own organization. This behavior can be expected because ACS sends emails from Microsoft’s cloud infrastructure rather than directly from my tenant.

As a result, Distribution Groups (DG), Dynamic Distribution Groups (DDG), or Mail-enabled Security Groups (SG) that are configured to accept messages only from internal senders will reject these emails. The common workaround is to enable “Allow external senders” on the group.

However, we don't want to open the group to the entire internet.

Does anyone else have the same experience? What is the best solution, exchange transport rules?

Thanks!