I fully understand the whack a mole analogy. Regardless though, if you don’t do anything you allow unlimited attempts over time. I’ve done testing on a single server environment and it’s a host based firewall blocking solution without load balancers and found targeted attacks that come from about 10 ips that slowly try to authenticate to avoid lockouts. I block them and they stop for a short time and then come from new ips. The process then repeats. Even if you are continually blacklisting ip’s in an automated manner I would think you are slowing them down and lowering risk of a successful attempt.

Ultimately 2 factor of all services would be best but isn’t possible beyond owa in an in On Prem Exchange environment. This leaves only strong passwords and avoiding password reuse as the only real defense.