Eliminating Spam but not valid business email- Exchange 2013 On-premises and using EOP through Office 365

We have Exchange 2013 running on site as our primary email system. We also have Office365 accounts for a separate domain.

I have setup the EOP to be used as the Antispam etc. protection for the on premises Exchange users.  I have been running circles around how to get it tweaked the best to eliminate the spam but also allow legitimate emails.

I have been adding domains into the contentfilter and senderid filters one by one on the exchange using management shell.  This is tedious and labor intensive.  It seems a lot of the legitimate email is showing an SMTP event ID Fail when I run a get-messagetrackinglog on the onprem server.

get-contentfilterconfig settings:

OutlookEmailPostmarkValidationEnabled : True
BypassedRecipients                    : {}
QuarantineMailbox                     : <a href="mailto:quarantine@.com">quarantine@<company>.com
SCLRejectThreshold                    : 9
SCLRejectEnabled                      : False
SCLDeleteThreshold                    : 9
SCLDeleteEnabled                      : False
SCLQuarantineThreshold                : 3
SCLQuarantineEnabled                  : True

Any suggestions for tweaks?  I have read a lot of information but it doesn't seem to improve anything.

Thanks.