How can I disable a phone from getting email if it's already authorized?

Ok so here's the update.

After a while, my Outlook app did come up and tell me I was blocked so it appears that setting the OutlookMobileEnabled setting does prevent people from getting into Outlook.

I also found these instructions that will push every phone into Quarantine when it connects:

https://blogs.technet.microsoft.com/praveenkumar/2015/08/19/how-to-block-or-quarantine-all-devices-by-default-in-exchange-online/

If I use the OutlookMobileEnabled setting, I can set that to False for all users and then set it to True once someone signs our policy document.  Pro is that it's on the user's account and not phone specific.  Con is that it has to be done through Powershell and I don't know if there's a way to make False be the default for all new users that get created.

If I use the Quarantine method, I can make this the default so all phones get blocked by default.  Pro is that it's automatic, it can send an email when a phone goes in quarantine, and it can be released through the GUI.  Con is that it's per device so any time a user gets a new phone, we'll have to release it.

Is there any setting that applies at the user lever, can be made defaulted to off for all users, and can be turned on/off from within the Admin portal?

Thanks.