Jan 15 2019 06:14 AM
Azure Conditional Access policies are pretty powerful, especially when applications accommodate their controls. OWA and SharePoint Online can co-operate with conditional access policies to block the ability of Office 365 users to download email attachments and documents. Although not a perfect solution, it's a good start.
https://www.petri.com/conditional-access-blocks-office-365-downloads