Sieve works for whole domains too:
There are sieve scripts in /var/lib/nethserver/sieve-scripts/. Don’t edit them directly, they are templated. I never tested this but it should be possible. Please share what you find out…
For sure. Shorewall firewall and fail2ban should keep the bad guys out.