In December, Microsoft Intune got a new feature that allowed for conditional access to email. Until now this feature was only available in the cloud solution, not in hybrid (Configuration Manager + Intune).
This feature allows for restriction to Exchange Activesync (EAS) or Exchange Online to only those users who have enrolled their devices. You can configure an exception list as well, so it’s not all or nothing.
This is one my favorite features, and it’s nice to see it roll over to hybrid now. The extension hasn’t shown up in my lab yet, otherwise I’d grab some screen captures.