APM - urls in the email are accessible when I launched though OWA session using access policies

I have tried to allow only those internal hosts which are required in the ACL and there is a deny statement which blocks access to rest of my resources. And this ACL is applied in the resources assignment tab.

To my understanding, with the above config, it should be block anything else from my APM. The issue is, if there is any URL (url to access any of my internal services like sharepoint in my emails ) I'm able to access the internal resources though my ACL has a deny. I'm able to access the internal sharepoint sites if the url is present in my emails.