@Stoiko, thanks for the suggestions.
Good plan to check pmgconfig dump, I will compare both pmg1 and pmg2.
In the meantime, as you suggest, I have used the templating system to override the postfix config, prioritising reject_unauth_destination:
smtpd_recipient_restrictions =...