I don't see using the "Reply-To" field as a kluge at all. This is exactly the type of situation for which it was designed.
You should not be authorized to send email on behalf of your users. A properly configured email server should reject forged email that is not sent from authorized email servers. Most domains now use DKIM, SPF, and/or DMARC that authenticate email for their domain. Any email sent by with your customer in the "From" field is not going to pass spam and forgery checks.
Since the emails are being sent to you, you are asking to carve out an exception on your own email server so that these emails don't get subjected to scrutiny. That may be possible (I don't know anything about Exchange, so I don't know how to do it), but it sounds very fragile. You would have to make sure that you can apply the same exceptions every time you upgrade your software or change email providers. At some point, that configuration is going to get break and you are going to stop getting support emails.
If you put customer email into the "Reply-To" field, pretty much everything works as you want it to.
- The emails come from one of your own addresses using your own SMTP server, so they pass spam checks
- The email get delivered to you
- Replying to the email replies to the customer
The only configuration you need to do is change your email client to show the "Reply-To" address.
I'm the author of an open source contact form that works using Reply-To. Originally, I had been putting the email address of the person contacting me into the "From" field. However about ten years ago my email server started rejecting those emails. Other people who were using the contact form also noticed this problem. To fix it, the contact form simply uses the "Reply-To" field now.
I run the Thunderbird email client. I configure it to show the Reply-To field in that mailbox using the "Correspondents" column. It works beautifully: