If the intent is for all inbound mail to go through the ESA, you point your MX records as the ESA.
You'll also want to configure "Centralized Mail Delivery"
We have had issues with outbound mail from on-prem Exchange to other O365 tenants.
Mail leaving on-prem is getting pulled into our tenant, and then leaves from our tenant... and since we don't have O365 in our SPF record, it gets quarantined. (we don't have any mailboxes in the cloud, but we have Teams... so you have to have an Exchange tenant). Centralized Mail Delivery used to fix this, but isn't any more, so we turned off the connector in O365...
As far as outbound mail from O365, you could set up a listener on the ESA on a different port, that set as a "relay connector", set up auth so only your O365 connector can connect to it, and configure the O365 connector to go to it. (I haven't done this, but its what I'd try first... )
Ken
________________________________
This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.
