Sorry, then I can only point you to the documentation of the used products, like dovecot, sieve, rspamd.
I have a similar setup with a Sophos Firewall acting as MTA in front of mailcow, the Sophos does all the spam filtering.
I have one global sieve rule which moves mails tagged by Sophos as Spam into the Junk folder of each user.
And defined the IP from Sophos firewall as forwarding host with disabled spam filter in Mailcow UI.
And whitelisted the firewall in Postscreen:
https://docs.mailcow.email/manual-guides/Postfix/u_e-postfix-postscreen_whitelist/
That was all I had to do, nothing else, and no mail else gets moved somewhere.