Unfortunately, in the Enterprise space, this setup is likely to be a zero sum game, as the challenge email would get dinged 90% of the time for spammy wording like "quarantine" and links to unknown domains (and/or blocked entirely, because inbound filtering != outbound filtering).
Large-scale email in its current form sucks, even with the Office 365 ATP tools or similar equivalents.
Large-scale email in its current form sucks, even with the Office 365 ATP tools or similar equivalents.