how exactly should I create it?
I do this sort of thing with a combination of SpamAssassin and ProcMail (which wasn't supported for a few years but now is supported once again).
SpamAssassin looks at all inbound email and ranks them for whether or not they're spam and you can add rules that indicate to SA that it's not wanted. And then ProcMail moves it to the user's SPAM folder or just deletes it, etc. That can be done in several ways but I like (non-virtual) users to have control via their ~/.procmailrc file.
In fact, the user can do it all with ProcMail, without Spam Assassin, I think. For example, in my own ~/.procmailrc file I have (the --- lines denote start and end of an excerpt):
---
:0
* ^From:.*northlightcolor.com
spam
---
...Of course, this is done at the SMTP / MTA level as in my config, Postfix calls SpamAssassin and ProcMail...