As far as I know, that literally is the only way to validate an email address, universally speaking, beyond an internal whitespace check.

But I think if you take "local" out of the equation, as you would for customer emails, you can validate a bit more. You might be able to validate on a single @ being in there somewhere, with something before and after it, maybe look for a period after the @ for "addr@domain.tld" as I think every external address needs a dotted domain.

That's about as far as I think you can safely go. Anything else is legal.