mobile outlook access

If ActiveSync is disabled for a user then APM/LTM wouldn't matter, the user would authenticate to the CAS server, then their CAS Mailbox would inform their device it's not allowed as a feature. Are you stating they're still able to use OWA instead of ActiveSync?

It's hard to block device specifics prior to activation because the entire auth process happens before this information is obtained by Exchange.

How are they configuring the mobile device to download mail if Async is disabled? IMAP, OWA, and other client protocols would still be allowed unless also disabled.