Defender on ios and Android Best Practice

Hello all, 

I have pushed defender app for my end users. As our organization has encouraged users to enroll their personal devices via intune, what are the best practice settings that we can configure via defender app without affecting user privacy. I am looking for best practice settings around url scanning and blocking when users access the urls in received via emails in their mobile devices. 
if it is not possible without web protection enablement in user devices forcibly, then what are the alternate options to perform real time scanning of urls and blocking malicious urls in their mobile devices