Blocking Email where From and Reply-To are different

It is a difficult one, because there seems to be plenty of legitimate reasons why these can differ. 

That I completely understand, but for specific groups within our org such as AP/Cash Collections they receive far more phishing and spam using this method than any legitimate email. It's become prevalent enough that Financial Fraud webinars now highlight it as a common threat to watch out for.  The ability to simply highlight it via a banner or quarantine them would be helpful.

Have you thought about tightening security on incoming emails in general? I.e. SPF/DKIM hard fails and others potentially held for approval or quarantined?

A quick warning email sent to staff that if it's in quarantine to be extremely suspect of it.