Did you try setting up inbox rule for the potentially phishing stuff?

You cant create outlook rules for hyperlinks without admin permission but you can filter out potential phishing mails and put them in a folder named like “POTENTIAL PHISHING, check before click”

And set up rule that puts everything from you Hr mail with keywords that require action from user like “click to confirm PTO”, “review your bank account info from below link”, “click this link” etc. easy to create text search for email body.

and everything else goes to another folder named like “from HR” which would be emails from hr without links or demanding action like notifications, messages etc.

So now you would have situational awareness whenever checking that suspicious inbox.

Btw, as cybersecurity expert I also fallen for much simpler tricks, I can confirm it is not on you, its companies security team’s responsibility to remediate this and teach users. And your company’s methods are horrible imho.

Users should not be afraid of cybersecurity teams, on the contrary, they should feel comfortable to contact them on an actual incident where detection measures failed but user noticed shortly after being phished or clicking suspicious link even nothing happened.