Thanks very much for your thoughts on all of this. Looks like daveteu have cracked it with the DNS change. But I actually think your ideas would also have worked, albeit a bit fiddly.
Regarding php, it is true you can use later versions on Ubuntu 18.04, but they are not in the default repos. You need to install via a PPA or directly. But either way, it will cause an immediate breakage to the webmail and nextcloud portals and it takes quite a bit of fiddling to get it to work again, after which I wasn’t sure it would survive an update.
However, I just realized I was being stupid and could just install an older version of the Mail app (the last good version being 1.4.1 as 1.4.2 has a bug preventing attachments from working). So I did that and applied daveteu’s solution and now have the perfect system.
I am seriously happy right now. As I mentioned in my reply to daveteu, this makes Mail-in-a-Box the only email solution out there that can do what you can do with G-Suite and O-365 in terms of multi-user management, enforcement of password strength and 2FA using USF/FIDO standards, while also having the integrations that Nextcloud offers, including Talk.
I believe that this takes Mail-in-a-Box to a new level that makes it very suited to a business environment and reckon the developers should do what Mailcow does and have a business offering.