Is it possible (e.g. like amavis can) to reject spam (at a particular level) or virus mails, so that postfix will send a reject message? Did you also check instead of SpamAssassin to use rspamd (because of performance)?
