The two typical choices are rspamd and amavisd/SpamAssassin, at least when you're using Postfix on a unity environment. I use amavisd on my primary and rspamd on the secondary, both seem to work OK.

Yes, spam will still make it through and you have to train the filters in either case.