Utilize email sandboxing to detect or block potentially malicious email attachments.

Sandboxing separates emails from your system while they are scanned for malicious links and attachments. If the email is deemed to be malicious it will be blocked. This prevents users from falling prey to phishing attacks.

Make sure the email service you use, scans emails for malicious attachments. Services like G-Suite and Office 365 do this automatically for their email services. For Office 365 you can purchase advanced threat protection, providing you with more capability. If your email service does not scan files for malicious attachments, then you will need to purchase a tool that does.