Tom,

When you put Xeams in front of Exchange, the outside world will never see your Exchange. It will only connect to Xeams and you can certainly use Let's Encrypt there.

You can certainly import the generated *.pfx file into Exchange but I don't know what is the benefit since no one on the Internet will be connecting to it. You can definitely use it for OWA. However, you will have to import the cert every 90 days.