crpb Milter works, but as I said earlier, "light" spams are not put into spam folder, they arrive directly into inbox.
Grommunio does not detect them as spam:
The only way I found to keep spams without putting them to inbox was to set quarantine in rspamd (/etc/rspamd/actions.conf) instead of add_header:
Now spams are stuck in postfix queue but at least they don't spam users inboxes...
Else, Rspamd correctly add headers to spams, but grommunio won't detect them and won't put them in spam folder.
