I ran into the same issue and found this topic on a web search, and it appears that (just like with the Microsoft 365 email servers before they dropped password-based authentication) only AUTH LOGIN is supported, not AUTH PLAIN which is the default in Discourse at the time of this writing.
Setting DISCOURSE_SMTP_AUTHENTICATION: login in the container configuration makes email work. Of note is, as well, that by default the only ‘from’ email allowed is the default DoNotReply@domain.example- if you don’t set this, your emails will get rejected with “550 5.3.5 Email sender’s username is invalid”.