OK, I think I have solved this.
You need to sign in to Windows 10 either with a domain or Azure AD account to use the Mail App with an Exchange Office 365 for Business or Enterprise email.
There's none whatsoever issues in enforcing the security policies (subject to these policies being set by your Azure AD / domain admin) and setting up the email accounts when your Windows 10 sign-in account is either a domain or Azure AD account.
weird, its always been working for me
OK, got this earlier resolved with signing in to Windows 10 with an Azure AD / Office 365 workplace account instead of a local or Microsoft account, now found the solution when signing in with a Local Account or an MS Account.
It's quite simple, in fact: all you have to do is first add a workplace account by joining the computer to an Azure Active Directory. On your account page in Settings, select Work access:
Set up the Mail App Exchange email account normally, select Enforce these policies when prompted and you are done. The Exchange email syncs now and works without any issues.
This is the same problem I am having, which I posted under browser and email "mail exchange 2010 activesync policy not applied" I have been able to get it to work on the windows 10 pro 64 bit version by applying the default exchange active sync policy, this install is using a domain account joined to our organisation domain, but the windows 10 tablet is home version, which cannot be joined to a workplace therefore ruling out your solution above.
On the Pro version it fails if I try to enforce the windows 8 policy that requires a password making it incompatible with our current organisation configuration as all windows 8 phones require a password for security
A post on the microsoft community has suggested editing the EAS policy settings in the registry I am in the process of trying this but not fully tested but will updated with any further information
I confirm that I have been able to get a windows 10 pro laptop that is joined to the corporate domain to sync with exchange activesync that has a mailbox policy applied that requires a password and will accept a simple password, by editing the local security policy settings using gpedit under computer configuration - admin templates - system -logon
1. Turn on PIN sign-in - enabled
2. Turn off picture password sign in - enabled
and add the following
REG_DWORD registry settings in HKLM\software\policies\microsoft\windows\system
DisallowConvenienceLogon value 1
However this did not work on the windows 10 home tablet that is not joined to the domain