I've got a small hosting system that includes Postfix/Dovecot and SpamProbe for a pretty good mailserver setup on Ubuntu 18.04. It will run in as little as 200 MB of ram in a LXD container when using SQLite as the backend. The Postfix main.cf file has a commented out section to relay outgoing mail through an upstream email account to get around blocked dynamic network ranges and I find a 5 minute Dynamic DNS update schedule is suitable for handling a MX record pointing to whatever device is handling incoming email on your port forwarded LAN IP. Better still is a DigitalOcean, Linode or Vultr VPS with a static IP but their network ranges are often also blocked by extreme blacklists. I'm happy to assist anyone willing to try this system...

https://github.com/netserva/hc...

You could try a dynamic bayesian filter system like Bogofilter or Dpsam. If the internal staff use IMAP then create a couple of training folders and let the end users train up their own filter database by dragging ham or spam from their Inbox and Spam folders to the appropriate retraining folder. A bash script on a 5 minute cron job can do the retraining, which is effectively instant retraining. Bogofilter on it's own in tri-mode (ham, spam, unsure) works great without even thinking about Spamassassin. I use Dspam now and get about 1 spam per day in my Inbox out of 100 to 200 spams in my Spam folder. It takes me 5 seconds to drag it into the retraining folder, ie; no effort at all. All spam is kept in the Spam.Unsure folder for 24 hours but that could easily be for a week, or more, so nothing is actually immediately deleted. If the end-user checks their Spam.Unsure and Spam folder every now and then for false positives then you don't have to do anything. Woops, maybe you need the job... hang on, leave things the way they are and keep your job.