Every configuration that involves AAD Connect/AAD Cloud sync requires that changes to the synchronized user objects are made in your on-premises AD. The only way to avoid that would be to disable synchronization altogether.
For the task at hand though, there is a workaround that you can leverage. You can use the Set-Mailbox cmdlet with the -WindowsEmailAddress parameter to "override" this behavior:
Set-Mailbox user@domain.com -WindowsEmailAddress new@domain.com
This adds new@domain.com as the Primary SMTP address for the user, while preserving the old Primary alias as secondary. However, this is not a supported method, and the changes you made might get overwritten on a full sync.