I know this thread is old, but in case someone is still struggling with this, I'll share my solution. For fun, I was looking for a possible workaround and came up with an idea—I can check what user-agent Outlook uses and then block access to the page if it performs prefetching with that user-agent.

I used a simple script:

file_put_contents("SERVER PATH TO PREFETCH LOG FILE", 
date("Y-m-d H:i:s") . " - User-Agent: " . ($_SERVER['HTTP_USER_AGENT'] ?? 'None') . PHP_EOL, FILE_APPEND);

Thanks to this, I found out that Outlook doesn’t send a user-agent at all. So, it was enough to block access to all "non-browsers" (i.e., requests without a user-agent). In my case, I placed the following code at the beginning of my PHP file:

if (!isset($_SERVER['HTTP_USER_AGENT']) || empty($_SERVER['HTTP_USER_AGENT'])) {
http_response_code(403);
exit;}

All known browsers use User-Agent, and so far, no one has had any issues