Exchange Online Best Practices

From an EMM / MDM perspective and on premise Exchange we would have a Secure Email Gateway (SEG) as a protection layer for email from devices.  With O365 migrations is there an equivalent SEG to protect email access only from managed devices for example? And secondly, are gateways as relevant nowadays and should we instead look at 2fa, Purview and Conditional Access signal related stuff?

Any best practices and complete answers I am very grateful for. TIA.