Adding a mail server to existing network

I’m adding a VM mailer and would like support on the new layout on my network.

I currently have a firewall that forwards connections to a VM nginx that deals with HTTP/HTTPS requests, forwarding to respective internal servers (wordpress, IIS).

I’m not sure where to place this new VM mailer. My initial ideia was to place it behind existing VM nginx, but then I wondered if I should place VM mailer directly connected to the firewall.

If I place behind VM nginx then I would have to add a listen server block to each additional ports (25, 587 and 80 for mailer.example.com) and deal with the internet noise on port 25. I wonder if this would decrease somehow my system performance, since this route is mainly for my IIS applications.

If I place directly into the firewall, I’m not shure how I could issue the SSL certificate (LetsEncrypt).

What’s the suggested approach?