This Petri.com article tells you how to set a policy on confidential Office 365 Groups to stop owners being able to add guest users to the group (or team).
Like all mail-enabled objects, Office 365 Groups can have multiple proxy addresses. Microsoft has fixed a bug in the Set-UnifiedGroup cmdlet so that you can remove proxy addresses from groups, but take care before you do.
The Search-Mailbox cmdlet is very powerful when it comes to removing items from Exchange Online mailboxes, but it can’t deal with other Office 365 content.
There’s a documentation bug for New-UnifiedGroup. You’re told that you can specify multiple owners when you create a group, but you can’t.