In order to be able to harden the TLS configuration of Postfix (TLSv1.2 + PFS ciphers), it is necessary to separate the SMTP traffic for inter-server and client communication.

The main issue is that a lot of mail servers out there may not support TLS 1.2, or might not be able to use a narrow set of PFS ciphers.

Separation seems to be possible, and client communication could be shifted towards port 587. Options to look into would be:

-o smtpd_tls_security_level=encrypt
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
-o smtpd_tls_mandatory_protocols=TLSv1.2
-o smtpd_tls_mandatory_ciphers=high
-o tls_high_cipherlist=DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA\
384:ECDHE-RSA-AES256-SHA384:!aNULL:!MD5:!EXPORT

This would require update to master.cf to include the above options, changes to main.cf, or some change in-between.

For smtp server comms, it would be necessary to set smtpd_sasl_auth_enable=no

Useful link - https://blog.tinned-software.net/harden-the-ssl-configuration-of-your-mailserver/

Docs would need updating too (both usage instructions and role reference). Don't forget the swaks commands.