Many, many thanks for your reply spuluka!
I'm sure I'd tried that before, but obviously had other things very wrong elsewhere at the time!
Now it's routing the *.*.138.218 IP inbound traffic to the port as required 
I fully intend to go through the online learning available from Juniper (as well as following your helpful tech blog), over the coming months, but this has really helped me out and I'm ever so grateful.
Just one thing that would be excellent to have working would be for traffic from that *.*.138.218 IP outbound to register as such, and not show as coming from the *.*.131.198 IP. Do you have a quick tip on how to get this implemented?
We can run as-is just now but really would like to separate our tenants email traffic from our own.