Against the current but well trodden, and the mechanics assemble from pieces you point at Gmail's IMAP face.

The bulk mail move at 40 mailboxes runs as an IMAP migration: Exchange 2016 migration batches accept an IMAP endpoint, imap.gmail.com with SSL, fed by a CSV of mailboxes and credentials, which for Workspace means app passwords per user or better, a service approach with per user consent. The batch copies mail into pre created Exchange mailboxes folder structure intact, labels becoming folders with Gmail's multi label messages duplicating into each, the one structural artifact of the direction worth warning users about. IMAP migration moves mail only, the boundary that shapes the rest of the plan.

Contacts and calendars therefore travel separately: per user Google exports, contacts as CSV or vCard imported to Exchange mailboxes through Outlook or OWA, calendars as ICS imported likewise, scriptable for 40 users or handled as a guided user task with instructions, the honest cost of the direction since the polished tooling mostly points the other way. SysTools Migrator style tools cover Workspace to Exchange as a single operation including contacts and calendars where the per piece assembly reads as too much friction, the build versus buy line sitting naturally around your user count.

The cutover sequencing is direction neutral: MX records move to the Exchange server after the bulk copy completes, a final delta pass catches mail that arrived during the copy and Workspace stays alive read only for a verification fortnight before its subscription ends. Autodiscover DNS for the Outlook clients, covered in its own thread linked alongside, deserves setting up before user one rather than after ticket one.