External Service Interaction SSRF IP address Vulnerability in JAVA

Question

I have a form which takes User email and password for Signup, and after clicking on submit button I send them a verification email to their respective email id using AWS SES. Only after proper verification user can use my application (Java Spring Boot Application).

But the problem is, on that point my application is vulnerable for the blind SSRF attack, attacker can use my application as a proxy to hit next service. Also anyone can see the DNS and IP using Burp Colaborator.

I heard about domain/IP Whitelisting & Blacklisting. But I don't want to block any IP or domain to use my application. What Can be the possible solution approaches to mitigate SSRF vulnerability using?

I also wonder what facebook, twitter and other services does to avoid this blind SSRF attack.