Another Option.....
If they are having problems with theft, then you might want to allow it to try to catch them, not just block stuff.
(in SM 14 Enterprise.) In the Domain "Events" settings. You can create an Event that any outbound email that does not match your internal domain, you can crate an action that :
1) adds an additional recipient to the email. So you could add "SecurityOfficer@yourdomain.com" (not sure if that is CC'd or BCC'd)
or
2) sends a seperate email to "SecurityOfficer@yourdomain.com" notifying them who sent what.
you can also set it to get a notification if they change their forwarding address too.
www.HawaiianHope.org - Providing technology services to non profit organizations, low income families, homeless shelters, clean and sober houses and prisoner reentry programs. Since 2015, We have refurbished over 11,000 Computers !