Device with Container Apps and Mail App
For a device (with MDM management) which is connected via the container application "Secrure Email" with the Exchange, we noticed the following. The end user can still connect to the Exchange through the regular e-mail client. Is it possible that we can ban a connection to our Exchange Server through the regular mail app?
A ban over a EAS is not possible because we have COPE with and without containers and BYOD.
Not sure whether this would help you, but an option for this scenario that I used before was to restrict the allowed devices via a throttling policy. Just create a new policy, set it to the number of devices the user wants to use and remove all devices or mail apps you don't allow via the ECP or EMC, depending on the Exchange version.
The Sophos App identifies itself in the Active Sync device list for the user.
This is not an easy to handle solution, but if you can't disallow devices via the EAS proxy probably the only one.