blocking phishing emails from Google Workspace

I was asked how an institution could block some phishing emails, which had the name of the current Vice-Chancellor in the "From" field, with some random gmail id. Excerpts from my reply:

1. Report phishing - You could ask the user to follow these steps - 

https://support.google.com/mail/answer/8253

2. From admin.google.com , blocking this particular email - 

You can set up rules using the method at

https://support.google.com/a/answer/1346934?hl=en

For example, you could put in a filter so that any email which has

• simple content search NameOfVC in headers
• AND is from @gmail.com
• should be blocked