Well, Google's own Postini does spam-filtering.

I could imagine a setup where you have people send mail to an alias on your domain, route it into Postini, and then into Google Groups. The big problem would be getting users _not_ to send directly to Google Groups. And I'm not sure you'd even be able to tell them (direct vs. filtered) apart in Google Groups...