Here's basically what I did in a testing environment utilizing two virtual servers.
You could do a split domain with the servers. On the primary, allow all attachments. Setup the secondary server does attachment blocking. Create the domain company.com on both servers. Lets say you want user1@company.com to get attachments and user9@company.com to have attachment blocking.
On the primary server;
Code:
zmprov cd company.com
zmprov ca user1@company.com P4ssW0rdhere
zmprov ca user9@company.com P4ssW0rdhere2
zmprov ma user9@company.com zimbraMailTransport smtp:secondary.company.com:25
We just SSH'd into the Primary and created both users, except user9's mailbox relaying to Secondary.
Now create the user on Secondary;
Code:
zmprov cd company.com
zmprov ca user9@company.com P4ssW0rdhere2
We also need a catch-all so user9 can email back user1;
Code:
md company.com zimbraMailCatchAllAddress @company.com
md company.com zimbraMailCatchAllForwardingAddress @company.com
md company.com zimbraMailTransport smtp:primary.company.com
On the secondary server Global settings > Attachments, block .zip attachments for example.
Now incoming mail to user9@company.com will hit the primary which allows attachments and relay it to secondary which blocks it. There's DNS work to be done here to make this functional as well.