Seems to me this is another case of MS not able to write secure software. If a device can access Exchange when it shouldn't be able to, the problem is not with the device but with the buggy MS software.....

Your external VPN interface should have its own IP address. That is a security best practice. If you are load balancing VPN connections, you should be using a VIP. Changes to VPN server IP addresses won't matter to the client. Using names for IP resolution works great for VPN connections until your DNS get hijacked!

Have your remote users connect to an IP address instead of a name and all of your problems are solved.