Old way - Exchange Admin Centre / Protection  / Spam Filter.  

New way - Office 365 Security and Compliance - https://protection.office.com/antispam.  

- Spam and bulk actions - leave defaults

- Allow lists - add as needed

- Block lists - add as needed

- International spam - leave defaults

- Spam properties - leave defaults

- Applied to - must add clients domain i.e. csdca.com

FYI - When you create the new policy in Office 365 Security and Compliance, it automatically creates a new spam filter in Exchange Admin Centre / Protection  / Spam Filter.  The new way is supposedly taking effect December 1st so not sure if the old way will disappear then but ok to start using the new way now.

Note: If it is just generic spam crap coming into one user I am asking everyone to block it themselves from  Outlook inbox - right  click - junk - block sender.