Exchange hybrid configuration question

Hi exchange online experts
 
We have in our environment exchange 2016 cu20, and we are using Cisco Iron Port as an email security gateway so any email that will come from outside to inside must pass via Iron Port
 
And any email that will go from inside to outside must go via Iron Port
 
Now we are planning to configure a long term hybrid configuration with exchange online, and I read that to enjoy a fully hybrid long term configuration you need to open not just port 443 on the firewall also need to open port 25 ((and I got to know the only support approach to use Microsoft Edge transport)) I am not sure about this info
 
Note: we don’t want to use a use hybrid agent because our target to have long term coexistence
 
So my question 
 

1. How can I reach my target by keep using Iron Port as the main email security gateway  and enjoying full hybrid long term configuration
2. Our firewall admin does not like to open port 25 on the firewall do you I have to explain to him something special

 
Note: we need to use also hybrid modern authentication 
 
 
Please take a look at the attached photos and if you need any more info to answer me please let me know 
 
 
 
 
 
.