On port 587 (submission, RFC 6409) the mail server accepts mail from clients, web apps and devices. The connection starts in plain text and is upgraded via STARTTLS; after that, AUTH is mandatory.
Port 587 or 465? Both are correct: 465 uses implicit TLS and is slightly preferred by RFC 8314, 587 works practically everywhere. Open it inbound for clients; in Postfix configure it in master.cf with smtpd_tls_security_level=encrypt and smtpd_sasl_auth_enable=yes.
Common errors: Relay access denied (client sends without login), Must issue a STARTTLS command first, or a client set to "SSL/TLS" instead of "STARTTLS" hanging on 587.
Check
openssl s_client -starttls smtp -connect mail.example.com:587 -crlf