You're absolutely right that for most Azure subscriptions (including sponsorships, free, and non-Enterprise ones), outbound port 25 is permanently blocked for VMs to prevent abuse, and there's no override unless you're under an Enterprise Agreement and explicitly request an exception (which isn't available to non-profits or small orgs typically).
That effectively eliminates Option 2 (Direct Send) and Option 3 (SMTP Relay via MX endpoint) in Microsoft's guide.
So you're left with Option 1: SMTP Client Submission (authenticated SMTP) — but as you noted, this is disabled by default for most tenants now due to security hardening (Basic Auth deprecation, etc.).
As per my understanding, If you want a more robust, secure method you can use a 3rd-party transactional email service (SendGrid, Mailgun, etc.)https://sendgrid.com/en-us
Additional ref: https://wpmailsmtp.com/twilio-sendgrid-review/
https://wordpress.org/plugins/wp-mail-smtp/
Hope it helps!
Let me know if you have any further queries!
If the information is helpful, please click "upvote" to let us know!