If the only thing a server uses mail for is system notifications, life can be simplified.
Skip sendmail/mail program installation and configuration. No need to worry if the SMPT server is a security risk. Instead, set up a simple script which sends all notifications via an HTTPS API to an MTA (Mail Transfer Agent).
How is this possible? Because any notifcation is sent using one of the executables mail or sendmail So those executable only have to be sustututed with links to out simple script file.