One way to do this right is to do trainings first, inform employees about future campaigns, and to only ever use reports from phishing campaigns in the aggregat

One way to do this right is to do trainings first, inform employees about future campaigns, and to only ever use reports from phishing campaigns in the aggregate to improve the training. You will never be able to block 100% of legit phishing attempts, your employee alertness is another layer of defence.