While SMTP forging cannot be prevented, and the underlying protocol was not designed with security in mind, you can minimise in postfix the effects of email forging by your internal users.
You can configure your postfix and clients to be mandatory to authenticate to send email via port 587 with authentication.
That does not however prevent them from sending email, however, it makes the life of spam malware more difficult (but not impossible).
As for gmail, they have lots of the customisations to the code, or even their own proprietary email server. Back when I managed an ISP, I collected and wrote extensions to QMail that did not allow it to forward emails that were not from our domain, and also only accepting existing authenticated users in the FROM field (e.g. double checking the FROM with the user doing the authentication)
To relay email only for authenticated users in postfix, make sure you have in the file
/etc/postfix/main.cf at the beginning of the
smtpd_recipient_restrictions directive the following two options:
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination
For more details, please check the official documentation at Postfix SMTP relay and access control