Thanks for sharing your scenario akosijesyang. It's an interesting one. As far as I can see, your valid options are to disable the default policy and replace it with multiple granular policies, however I don't see the condition "activity is MaliciousUrlClick" as something you can add to a custom policy. The other options are to disable email notifications for the default alert policy so that the alert just appears as an alert within the console, or to change the recipients of the email notifications to something other than tenant admins. Not ideal, given your goal.
Thanks, Ash
