Can I block the ports for BIS listed here to prevent OWA access on Blackberry phones and force users to connect through our BES without interrupting BES traffic?

KB11036-Firewall and connection requirements for the BlackBerry Internet Service

That would be a yes you can, it's actually the easiest way of doing it.

block inbound 443 and/or 80 (depending on your setup) from all those IPs listed on your firewall and none of your BlackBerry users can get OWA anymore.

Also block IMAP and POP3 if you are using them.

__________________
------------------------------------------------------

Torch 9800 on BES 4.1.6 MR7, Exchange 2003, SQL 2005.
WES 2009-2010 Survivor

Or block OWA from direct Internet access..... which is the better/safer practice.

We can't block OWA from internet access because it's used by many employees after work hours. The main worry is unauthorized devices. While it won't block anything that isn't a Blackberry, it will take care of the biggest offender in this case.

This is why we have VPN's Just about all the companies I have worked with have disabled OWA outside of their LAN for security reasons.

In this case it kills several birds with one stone. It will block ALL rogue devices using active sync that may not support security policies needed by an organization.