Can one restrict users with SMTP rules?

Question

I am running Mac OS X 10.9.4 with OS X Server 3.1.2 and Workgroup Manager 10.9. These applications are running on a Mac Mini Server (Late 2012).
Between the Mac Mini Server and the Internet sits a WatchGuard XTM 25 Firewall & Router.
I have been tasked with limiting all user accounts except for a select few with respect to SMTP rights.  The rules should be as follows:
All employees have the ability to email another employee.
All employees have the ability to email a single remote address, which receives electronic faxes.
Only 3 employees will have unrestricted rights to mail outside addresses.
Mail accounts must be created and destroyed by the OpenDirectory maintained on the OS X Server, ideally via the OS X Server app.
Is it possible to do this with the equipment and applications listed?
Is it possible with equipment and applications not listed above?
All ideas and suggestions are appreciated.
I have tried looking for SMTP servers that can be installed in conjunction with OS X Server, but not yet found anything that seems viable. I have also attempted to find any information about setting advanced rules for OS X Server Mail, but have mostly found rules regarding incoming mail, and not outgoing mail.  The documentation on OS X 10.7 seemed promissing, as it suggested that the version of OS X Server available at that time had firewall settings which might do the trick; however, OS X Server 3.1.2 does not appear to offer firewall settings.

Answer 1

Thank you, MrHoffman!
I have actually been playing with the header filters and other internal postfix settings since I made the post. Sadly, attempts at restricting my own mail usage have all failed, so I do not yet know what I might be doing wrong.
On Mac OS X there are two postfix folders: /etc/postfix and /Library/Server/Mail/Config/postfix.  Naturally, it is the second folder which we must focus on, as this folder is the one maintained by OS X Server.
I have backed up main.cf (/Library/Server/Mail/Config/postfix/main.cf), and edited the header_check value to the following:
header_checks = regexp:/Library/Server/Mail/Config/postfix/header_checks
And then added the following to /Library/Server/Mail/Config/postfix/header_checks:
#Added by Jared Clemence
/^From:.*jaredclemence/i REJECT Test successful. Mail is blocked.
/^Subject:.*reject.*\s{1}me\s{1}/i REJECT Test successful. Mail is blocked.
The documentation for HEADER_CHECKS(5) notes that header checks will not check the "From:" field in the "bugs" section. So I added the "Subject" line to at least verify that the filter was taking effect.
After making these changes, I ran:
postmap /Library/Server/Mail/Config/postfix/header_checks
as well as turning off and then back on the Mail Server from the Server app.
So far, none of my tests have produced a successfully rejected message.
Any tips?