Exchange Classic Hybrid Connection Security

Looking at the setup Wizard for Exchange Classic Hybrid I'm wondering if once it is setup communications are obviously over 443/35 TLS 1.2 is there any mutual authentication between our Exchange Servers in our DataCentre and the EOL hybrid connection points? If so, how is this done (certificate etc.) ? The reason I ask is we have to open ingress ports on our edge for EOL to send mail inwards as we are keeping mail flow on premise.