exchange 2016

Hello, I am running a single Exchange 2016 server in hybrid mode with O365. I have an issue where I need to block OWA access to the on-prem server from internet access, without affecting any of the hybrid communication. Port 443 is, of course, the port it uses. Does anyone know where I can...