Set up SPF, DKIM , DMARC and MTA-STS for your organization
Block users from sharing personal data outside school e.g. NI numbers, NHS numbers, URT tax numbers , credit card details , bank numbers etc- Make sure to add your office admin team to bypass the rule.