Did you ever find anything for this? I have the same issue for numerous customers.

Normally, you just restrick SMTP traffic to only the cloud filter. Set your firewall to block all but allow the IP block from the cloud filters. That way if they don't use your publicly listed MX records to send email, then your firewall will not allow them to talk to your mail server. Hope this hel...