Well I got some help in another forum, which is disappointing given that this is supposed to be the go to for Zentyal help. But anyway, I took a chance at reformatting the /etc/postfix/main.cf file to eliminate the long single line format of the "# recipient restrictions" area. By doing it this way the changes stayed after a service restart when previously they would disappear (odd to say the least), and the "Mail" logs show the incoming spam being rejected based on spam blocklists which is everything I wanted to accomplish.
# recipient restrictions
smtpd_recipient_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
reject_unauth_destination,
reject_unauth_pipelining,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_invalid_helo_hostname,
reject_invalid_hostname,
reject_non_fqdn_helo_hostname,
reject_rbl_client dnsbl.sorbs.net,
reject_rbl_client sbl-xbl.spamhaus.org,
reject_rbl_client bl.spamcop.net,
check_helo_access pcre:/etc/postfix/helo_checks.pcre
permit
submission_recipient_restrictions =
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
permit_sasl_authenticated,
permit_mynetworks, reject
smtpd_restriction_classes = submission_recipient_restrictions
The newly formatted configuration seems to survive the service restart and does seem to show new spam being rejected in the mail logs. So for now, so far so good. I am going to keep a close eye on this setup for a few days to make sure valid email is not being interfered with, and will post something if it is causing issues.
Hopefully this may help others.....