I think you’re out of luck with macOS Mail. You want to identify mail that has been sent or copied to someone outside your company (call it mycompany.com), which mean you’ll a rule along the lines of
TO: (or CC:) “contains” NOT mycompany.com
As you rightly say, that different from “does not contain” mycompany.com, which will only work if the external address is the sole addressee.
From the fact that you mentioned Outlook, I guess that your company may be a Microsoft house, in which case it’s probably using Microsoft Exchange as the mail server. The server will know which traffic its directing to external domains and can apply processing rules to it using “mail flow rules” (also called “transport rules” (see https://docs.microsoft.com/en-us/exchange/policy-and-compliance/mail-flow-rules/mail-flow-rules?view=exchserver-2019), so perhaps your company’s IT people could help.