Looking for script module to keep UPN insync with Email attribute

The domain name of our AD forest does not match the second half of our e-mail addresses - i.e. Domain FQDN = internal.company.us and SMTP Addresses are @company.com.

Now that we are looking to enable hybrid modern authentication with Microsoft 365, we want to make sure that user's UPN always matches the value of the Primary SMTP Address of the account (attribute Mail).

Our delegated administrators will be able to customize SMTP address, so I thought the cleanest way to do this would be:

1) run a script to change all UPNs to match Mail attribute

2) use a Policy Object to enforce a Script Policy to make the change on actions like onPostModify, onPostCreate, etc.

I figure it has to be a onPost-type script module because it will need to set the value before it can read it. (During testing - I see that when ProxyAddresses is updated, ARS also updates the Mail attribute, so that's why I'm using that one)

I've got the onPostCreate function partially working but trying to check if the User object is a mailbox (by looking at value of homeMDB) before continuing to run the script.

Wondering if folks have done this before.