Delivery of inbound mail with a harmful link has passed SMG checks and has been delivered to the recipient.
Ensure that customer-specific URL category list is enabled and certain categories are assigned. Once set up enable spam policy called "Customer-specific Spam: Quarantine message".