Not that familiar with postfix... but, I know that procmail can do what you are talking about. Have you looked into that? Each user has his/her own .procmailrc that can be changed by them... then there is a system-wide /etc/procmailrc that applies to everyone managed by the sysadmin.
I've heard of people using it with postfix (I've been a sendmail guy, and I know it works beautifully there), so this could very conceivably work for you... Check it out

To look without without looking within is like looking without without looking at all.