How do I block inbound mail to O365 from external senders?

I have hybrid configuration with centralized mail transport through my on-prem exchange server.  Mail flows fine but I found phishing emails from other tenants do not use my MX to route mail but, ins...