Quarantine or save SPAM based on rules

[Kham Vue]

We've got a few customers in our network that are sending SPAM. We have a a
firewall and every IP address is NAT so the IP addresses are different each
time.

Is there a way to quarantine or save SPAM emails based on an IP address
range?

For example, if IP X.X sends SPAM, it saves it.

My current solution is I forward all SPAM to a mailbox, every 5 minutes GREP
for my IP, if found then copy it, else delete box.