My perspective on spam filtering:
Yes, you absolutely need a spam filter that can do complex filtering using multiple-attribute rules, such as
"Quarantine invoice messages except, for addresses in our accounts payable databases or in our exception list." I use Declude from
MailsBestFriend.com because it is fully customizable and I have customized it heavily. Most of my filters query database tables that return results based on longest-match to an identifier. This allows me to have an unlimited number of allow and block rules, while database indexing ensures that large lists can be processed efficiently. I also believe that every message should be authenticated, because malicious impersonation is always a threat. So I have local policy rules to provide alternate authentication for messages that are acceptable but do not provide authentication by algorithm. Code for all of this is available to interested parties, but interest has been minimal.
Spam filtering should occur on an inbound gateway server that sits in front of your main server, not on your main post office server.
rSpamd is an interesting alternative, because it is also customizable. I have become very cynical about commercial products because they are not customizable and do not have adequate protections against malicious impersonation.
Recipient verification is important because it can be used to identify and block a lot of unwanted mail. I do it as part of spam filtering, after the SMTP session is closed. Messages with no valid recipients are discarded silently and quickly because I do not want to assist directory harvesters. To minimize workload on my main server, I extract valid user accounts to a database, then perform recipient verification against that data.
If SmarterMail is your spam filter, you have a limitation that most of the features are not invoked until after the SMTP session is closed. I am OK with that because i have decided that I do not want to give any information to attackers, so all unacceptable messages are quarantined or silently discarded. If you want to filter within the SMTP session, you need to use a different MTA, and it appears that PostFix is the most interesting alternative.
User Accounts
The login username and the email address can be different if you use a third-party authentication system. SmarterMail support ActiveDirectory, which I use, or LDAP
User Groups
We use both the aliases and mailing lists to do user groups. I am not sure what additional features you are looking for.