Automatic responses when away

Exchange default setting for OOO assistant is to send auto-reply out of office messages ONLY to inside users. I think that's a good idea to prevent replies to spam that slips past our filters. The Outlook junk mail settings allow one to mark as safe emails from those to whom one has sent a message - do those OOO replies count?

The more spam, the more opportunity for someone to open something that's new and harmful.

We had it set to the default, but our business people want to send OOO to outsiders (instead of forwarding, naming a surrogate, or other, more reasonable steps). We also have a fixed group of insurance agents (our customers) that we could include in a "white list". No dice with that one, either.

What say you? Do you allow it? How do you protect yourselves?