You have the right solution. Doing the delete ensures that the ID file corresponding to that employee's entry is invalidated, which ensures proper security for the company's information.
Of course, you need to check the appropriate option, as you have stated, to keep the actual mail file without allowing any more mail to come through.
You might want to check that the ex-employee's hierarchical name is in the Deny Access field on the server document before you do the delete . . but that may be considered slightly paranoid.
Be aware, though, that mail can still be sent from the deactivated mail file, unless you set access permissions to Reader.
Another, less efficient, way of doing things would be to erase the mail file path from the Person document and enter the name into the Deny Access on the server document. This should work, although in theory it could be considered sloppy administration and leaving a loophole. After all, the person being gone, there is no reason for his name to be showing up in the NAB anymore.
Pascal.