block compressed attachments with password

Password protected archives (e.g. zip-files) can get detected by clamAV as Heuristic - you can enable this in the virus-detector settings.
This then causes the spam-detector to add the heuristic score as points to the spam result, which you can use in the rule-system
see:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_clamav

I would set the heuristic score to a rather high number and then either quarantine or block mails which reach that number

I hope this helps!