Best practice to protect OWA

Hi experts, I've a task to protect OWA. Seems to me that the best way to protect is to use APM. But what about AWF? Is there any articles that compare APM vs AWF in case of protecting OWA?