Force AIP labelling/protection

Soon enough the Azure Information Protection client will be build into the Office Pro Plus clients, effectively solving one of your issues. Until then I think your best bet is to utilize Azure Information Protection in conjunction with Data Loss Prevention for sensitive data types.

In AIP you could enforce that all documents must have a label and ensure that all documents starts with a default label. It won't solve all you headaches, but It's a start I guess.

Also you can enforce transport rules through the Exchange Admin center, that will add protection to content that is being sent externally, even if that content is sent from devices or applications that does not support adding labels or protection to content.

https://docs.microsoft.com/en-us/azure/information-protection/configure-exo-rules

You can also enforce Information Rights Management in selected or all SharePoint/OneDrive document library locations, to ensure protection for files located there.

https://docs.microsoft.com/en-us/office365/securitycompliance/set-up-irm-in-sp-admin-center