You can block common attachments (attachments commonly used as malware) in EOP but not all attachments as required in this question. Instead, you should create a mail flow rule. Reference: https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/common-attachmentblocking-scenarios