Control access from Outlook to Exchange Online

Conditional access would be ideal for this but would require additional licencing: 

https://docs.microsoft.com/en-us/intune-classic/deploy-use/restrict-access-to-exchange-online-with-microsoft-intune

Also this one - https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access

Ruling those out because you mentioned you only have Office 365 E3, do you use AD-FS to federate identity in your tenant? If so there are options there:

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/ad-fs-client-access-policies

https://technet.microsoft.com/en-us/library/hh526961%28v=ws.10%29.aspx

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/access-control-policies-w2k12

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/access-control-policies-in-ad-fs-2

This isn't something I have had a chance to try out, maybe someone else will say what works well for them with this type of scenario!