What are the differences between the Home and Business editions of Office 365

There is no option besides SSO, and gcontrol is the cheapest. Google is designed to be accessed from anywhere and until they implement a free solution to restrict access to IPs or times, only 3rd party SSO solutions with that feature will accomplish what you want to do.

Obviously if you want to truly restrict all email download to be in certain locations/times, you'll have to turn off POP and IMAP access. I use gControl and it works quite well.

We had the same concern. So we created a new site collection specifically for surveys. Then we turned on the setting "Allow both external users who accept sharing invitations and anonymous guest links: in our Tenant, and turned it off for all site collections except the one we will use only for Excel Surveys.