Blocking access to Exchange from mobile devices....sorta

We use an MDM solution to control access to email; if you're not using the MDM, you don't get email, simple as that. However, there's one exception to the rule...the CEO. Without getting into that discussion/argument, is there anyway I can tell Exchange/IIS to not give email to certain users unless they come in on the MDM IP address?

I used to lock down email access to the IP address of the MDM servers, but that won't work in this situation as a mobile device can take on many IP addresses.

Thanks