The client should be responsible for their inbox, and most control panels will have some form of account-specific spam filtering tools. However, filtering at the server level can decrease the pounding your network takes, and can make your clients' lives seem easier - they have fewer spam filters that they've got to put in place.
It takes research; but you can use a number of RBLs to create your server-side filters.
Just err on the side of caution, when in doubt about an IP let that traffic through - and if you've got a support database or FAQ, let clients know to contact you if they discover that they're not receiving someone's email when they want to receive it. You can whitelist the domain or IP address, and still block any other potential junk that tries to get through from that sector.