Add "ClickProtect" to protect against malicious links within email
My previous filter provider had ClickProtect and I worked VERY WELL. Here's a description:
ClickProtect leverages GTI® Web Reputation to safeguard against web addresses that link to malware and phishing sites. Each web address is evaluated when the message is scanned in the cloud ("scan-time") and later, when the user clicks on the web address ("click-time").
Check out SafeLinks, available as part of EOP Advanced Threat Protection: