Microsoft Defender Exploit Guard contains the Attack Surface Reduction (ASR) rules. The specific requirement to "prevent Microsoft Office applications from launching child processes" is directly addressed by the ASR rule named Block all Office applications from creating child processes. Microsoft Defender Firewall is used to control inbound and outbound network traffic for a device. To "block users from transferring files over FTP," a custom firewall rule must be created to block outbound traffic on the standard FTP ports, TCP 20 and 21.

Microsoft Learn | Official Vendor Documentation:

Attack Surface Reduction Rules (part of Exploit Guard): This document details the ASR rules available in Microsoft Defender Exploit Guard, including the rule to block Office applications from creating child processes.

URL: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attacksurface-reduction-rules-reference?view=o365-worldwide

Relevant Section: "Block all Office applications from creating child processes"

Microsoft Defender Firewall with Advanced Security: This documentation explains how to create firewall rules to block specific protocols or ports, which is necessary to block FTP traffic.

URL: https://learn.microsoft.com/en-us/windows/security/operating-systemsecurity/network-security/windows-firewall/

Endpoint protection settings for Windows 10 in Microsoft Intune: This page explicitly lists both "Microsoft Defender Exploit Guard" and "Microsoft Defender Firewall" as categories within an Endpoint protection profile and describes their functions.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-protection-windows-10