I'm sure there is a doc somewhere, but I believe the flow is what the incoming mail policies show. spam->virus->malware->graymail->content filters.
But I can't verify as I have seen stuff pending a file analysis get quarantined, but still go through content filters. This may be due to the flow pending analysis.
If you want to redirect, but do it with a content filter, then have the message continue and set some type of header flag you can check in a content filter. such as set X-AV-unscannable=true and then use a content filter. The downside is I don't think you can quarantine with a content filter. We redirect to a mailbox we have access to and notify recipient.
The only way to quarantine and do content filters that I can think of is you would have to do the x-tag, have a content filter redirect it to a separate listener on the device. You would probably have to change the recipient to an unused address you could key in on in the mail flow policies to cause a different flow so you could set those AV parameters to quarantine. Not an easy setup.
