Limit access to Exchange in a hybrid environment

[Gly]

Hello everyone,
We have a hybrid environment running Exchange 2016. All our mailboxes have been moved to the cloud. The Exchange server is only used for management and relays yet it is still "exposed to the internet". In light of the recent vunerabilities it is high time I limit the access. 

Now, I would like to close off as much as I can without 'breaking' anything. Does anyone know of some good resources describing this? 

[#2]

It probably would be some combination of settings from those areas:
https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-world...
https://docs.microsoft.com/en-us/exchange/transport-routing?redirectedfrom=MSDN