Why don't you set up your own intermediary server running spam assassin and pass incoming mail thru it, but do not use the default config. On a corporate network (which is what I assume this is) you can set it up to score the incoming mail based on several filters, RBLs or whatever. Each "hit" the incoming mail gets on the filter would add to its score, and you'd then have a threshold which would either deliver it to a spam folder or block it outright. I'm not a fan of content-based scanners so I would put a lower weight on that, and a greater weight on the sending IP/domain reputation.
Generally:
zen.spamhaus.org
is decent in general.
cbl.abuseat.org
is more-less the free version of what spamhaus would charge you for.
bl.spamcop.net
spamcop, which is now owned by cisco and is essentially what you'd get with ironport.
There are also a shitload of smaller lists which I generally do not recommend subscribing to.