Hi,
We have just installed SurfControl Email Filter on our Exchange Server 5.5 (NT4 Server) that is already running Groupshield. I had the same concerns as you, but we got it set up crrectly.
SurfControl is now port 25 and the Exchange Server is port 26. Any new email into our domain goes through this order:
Incoming Mail>SurfControl>Exchange Server>Groupshield>Individual mailboxes.
Runs fine.