Reducing the surface for bypassing SMG, ensuring inbound messages will not be delivered without SMG involved.
In order to reduce the surface we need to ensure that only IPs reserved for SMG will be exposed publicly - then each single inbound email will be routed first to SMG and then to final MTA - Exchange server, so the proper routing can be set on SMG and Exchange connectors.