Some quick comments.
You've got a fixed IP which is really not needed - many DNS providers today do dynamic updates - but is handy to have.
You will naturally have a DMZ since you will have port 25 world wide open, you really cannot run a MX without it.
You mention you have an external VPS, I assume it's Linux. I would install postfix on that VPS and use it as backup MX, you probably want to queue your own mail when you have maintenance windows and miss receiving or if you're on a weekation and the power drops and the server don't come back up. SMTP servers usually have retry algos and keep trying sending for up to some 96 hrs before returning errors but I think it's nice to have backup MX anyway - it makes sure the sender don't get any kind of warning or dealy info sent back (this may or may not be good that's up to you I guess).
I would also use that VPS for outbound SMTP (to the world), since it's most likely non-residential and non-dynamic IP that will probably work fine. If you want you could set up VPN site-site to that VPS and tunnel outbound mail plain from your local mail systems in that tunnel and also receive rsyslogs from the server over the tunnel to a central syslog server.
The mail system that the users use can be many things and it all depends on how many servers you want to have in the mail design - myself I have 3 locally in my personal network handling different aspects of the mail feed.
I would strongly suggest you look into Zimbra as your main mail engine, webmail and collaboration system alike. Quite possibly the best I've ever seen and I have used a number of mal servers/system during the years.
Other options may be Zarafa and possibly Axigen.
Remote access to mail can be over OpenVPN (demand everyone including phone to first setup tunnel before accessing services) or a mix, perhaps you'd like to have https, pop and imap open to give users flexibility.
I'd recommend using Snort to increase the likelyhood that you notice if there's a lot of malicious activity going on.
I'd also recommend using some blocklists (you can do that in FW-rules instead of Snort) like ET IP lists, CINSscore and Talos.
Be wary of DNS block lists (real time block lists) in the SMTP system, many give you issues of false positives, the only I use on and off today are Spamhaus and sometimes Spamcop. Rejecting SPF failures may also give you some issues but is a nice thought I think, unfortunately there's a lot of admin that do not keep accurate SPF records.
Just a few various thoughts on the subjects.
Regards,
