There's a proxy server that supports pop3 called prometo on sourceforge that recently added SA support. I've tested it with qpopper, and it works good with SA, but there's no way to do per user rules. Pretty cool to do this on the pop3 side tho.
Normally, SA is installed as a milter in sendmail or with another MTA.
We use procmail to deliver to users' mailboxes, and run spamassassin from there. As a result, we can enable/disable on a per user basis. Allowing users control is still an issue, though.
