Secure document pending- email users are getting- Urgent!

Are you meaning blocking "all" of those types of messages? Would a domain block suit your purposes?

This is one of the most obvious phishing messages I've ever seen. Treat it as such

@David Johnson
I totally agree with you in so far as it's an obvious phishing message (or even perhaps an attempt to install Malware or Ransomware on the recipient's computer)

The author's issue, however, is "how to block" - if it's getting past O365's pretty good spam filters, then the question still needs to be answered as to what solution to recommend. If these messages are all coming from the same domain, an additional Spam filter such as Mailwasher could be of huge benefit here and an easy fix.

Likewise if the messages the OP is concerned about all contain something that appears in all of the emails he's concerned about. A solution is difficult to recommend without knowing more about the emails and a sample of the email would actually be a huge benefit in being able to suggest a solution, though I hesitate to ask for one to be uploaded for obvious reasons.

It came with internal user name and had pdf attached . Asking to enter email ID and password. Couple of users did open the attachment.  
1. How to block for future occurrence
2. What would be the preventive actions
3. How to clean the system if a user clicked on the pdf attachment