A little confused on your wording, are you saying only whitelisted domains can send in attachments, and users can only send attachments back to whitelisted domains?
If that, then it would depend on how you do the whitelists. If you use policies to separate the whitelist into different flows, then make a content filter to strip attachments and apply to the non-whitelist policies. you would also need to do the same on the outbound.
If you use a whitelist in the HAT, then you can still do content filters, just need to do them a bit different. You would probably need to do a dictionary of whitelisted domains. Since you can't do does not contain from a dictionary, I would do 2 filters. If the dictionary matches, skip remaining filters, then after that make a filter to strip the attachments. Also needed to do on outgoing.
if I'm mis-reading your question let me know.
