I know you can do it with Google Apps. Have not tried with Office365.
After sleeping on it... I am not sure it would work with managers. They work with outside council on a day2day basis and they use attachments for that. I wonder why gmail hasn't made phishing attachments obsolete.
If you just blocked zip files, it would be a good start.
Gmail does block quite a few attachment types. Zips are tricky because they're a very common way to send a collection of photos or docs or similar.