I'm curious, if you have a smtpd service in master.cf that listens on an IP address, if it would be possible to restrict the recipient maps just to the recipients in the domain associated with that IP address (there are other smtpd services/domains/IP addresses on the same postfix instance).
I tried a simple test, adding "-o" options to override virtual_mailbox/alias_maps, but it seemed like I also had to override transport_maps/mydestination (not sure which) and I could make it "work", but it seems clunky. The rejection is not a "no relaying" error, instead it complains about unknown domain. So I think there is probably a better way to do this, no? Is the only right way to run multiple instances? Or can I override in master.cf with the right combination of settings? Thanks