You cheerfully ignored the “other employees clicking random phishing links” issue that is non-trivial to solve by simply outsourcing SMTP server hosting.
You can't fix that with managed hosting either. If you think going with Workspace or O365 fixes that then I have to wonder what businesses you've been working at in the past.