rspamd is as good as it gets, you can run it locally, you need to train the filters "of course", but you can do it incrementally - as mail pours in you put spam into the spam folder [0], and rspamd (via rmilter via postfix) puts a X-Spam-Flag header into the mail, so sieve (part of dovecot) sorts if out [1].

of course, there are a bunch of cloud/hosted/SaaS versions, usually they front-proxy your email servers via MX records [2]

[0]: https://thomas-leister.de/en/mailserver-debian-stretch/#spam... [1]: https://thomas-leister.de/en/mailserver-debian-stretch/#glob... [2] https://www.everycloudtech.com/