Same answer here: Use a separate firewall which can do such things in front of mailcow.
I use Sophos Firewall which is even better because it can detect malicious web requests and block them.
Also I use abuseipdb.com IP addresses for blocking.
You could also block certain URLs with the hardening features of a web application firewall.
In general, mailcow was meant to be put directly into the internet, it enforces firewall rules itself via netfilter and iptables, it has also fail2ban functionality which stops brute force attacks.