In a general setup if your environment is running O365 too, Cisco recommends to have a separate private listener configured and point outbound emails/connector from O365 to this private listener.
The next step would be creating a RELAYLIST sender group (.protection.outlook.com as a e.g. hostname) based on the private listener, this way emails coming in from your O365 tenant would be considered outgoing while all other externally originating O365 emails are considered incoming since they hit a different listener.
