Look into doing greylisting. I do that for my own setup, and I've found it easily cuts down on the spam by at least 50% and that's without even looking at the email.

I’ve used greylisting for the last five years or so. I stopped doing so completely and moved to Fastmail. Greylisting delays, while unnoticeable with the contacts I frequently communicate with, were very annoying with new and one-off contacts, especially all sorts of confirmation emails from bank etc, which would often expire before greylisting allowed them in. Sometimes, emails were sent through cloud mailing systems, so coming from a different host each time they’d hit greylisting again and again and again.

Rspamd falls back to sqlite if you do not have Redis configured