Sort of, this will be sent to the approve queue if DMARC fails, but if it is totally absent it will still go through.
Perhaps one way of pushing forward would be to add an explicit site setting that basically say “site operator accepts risk” and if enabled allow mapping based on email