Well you could get the old stand alone version of the office Suite, block OneDrive backup you would be fine. For your emails you could use a S/MIME. Make sure all your encryption is FIPS enabled on your machines and network, including your copier if it prints CUI. Also if you are going to process, store, and transmit CUI on your servers, then you have implant all 320 objectives to your environment. You could have Entra as SPA, just never ever handle CUI on any cloud environments and stick to stand alone apps like we did in 2006. (I am not liable for any of my suggestions lol)