Split-tunneling is your friend with O365. Let that traffic go out their local internet connection and stop backhauling it across the corporate network.
That's what we do. Works great and your end users will thank you.
Because I’m a contract worker, for one - and because our InfoSec team does not want that to happen.