ADFS Claims Based Rules - I'm stuck!

In my environment we are running Exchange 2013 Hybrid.  All mailboxes are in O365.  We have certain requirements around our implementation that require ADFS.  With that being said, I am really struggling with coming up with the set of claims based rules to accomplish my goal.  Our ADFS environment is in Azure (vpn to on-prem network, 1 DC, 2 ADFS servers, 2 ADFS Proxy).  Federation itself is up and running fine.  I feel like I have read the same handful of technet / blog post articles on setting this up but I must be missing something.  I am also struggling with being able to debug / trace to see excatly which claims are coming in with their values to determine why I am not getting expected results  

Here are the scenarios that I need (and have rules for):

1.  Block external Outlook access unless user is in the ADFS_Allow External Outlook AD Security Group

	exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
	 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/services/trust/2005/usernamemixed"])
		 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.Autodiscover|Microsoft.Exchange.OfflineAddressBook|Microsoft.Exchange.RPC|Microsoft.Exchange.WebServices"])
	 && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\bXXX\.XXX\.XXX\.XXX\b|\bXX\.XX\.XX\.XX\b|\bXX\.XX\.XX\.XX\b"])
	 && NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "\bS-1-5-21-XXXX-XXXX-XXXX-XXX2\b"])
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true"); 

2.  Block external OWA unless user is in the ADFS_Allow External OWA AD Security Group

exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
 && exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/ls"])
 && NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "\bS-1-5-21-XXXX-XXXX-XXX-XXX\b"])
 && NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\bXXX\.XXX\.XXX\.XX]\b|\bXX\.XXX\.XX\.XX\b|\bXX\.XX\.XX\.XX\b"])
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true"); 

In both examples the IP addresses included in the regex are the public IP addresses of our 3 locations.  IP and SID have been redacted.  

I have looked at the insidecorporatenetwork rule vs the proxy / forwarded-client-ip -- and either way, I can't seem to get anywhere.  I would really love to be able to trace end-to-end to view all of the claims and values to understand why someone is allowed / denied access.

Any help in pointing me in the right direction would be greatly appreciated.

Steve