Finally I found a workaround to not depend on sendmail to forward messages using sieve:

In postfix main.cf I have:

authorized_submit_users = root, filter

(I want only root and filter to use sendmail and block other users to send e-mails from system accounts. Only allow users to send e-mails from virtual accounts and after smtp authentication. Username filter is used for bogofilter and needs access to sendmail)

And in dovecot.conf:

submission_host = 138.201.248.xxx

The same workaround maybe works for NoNewPrivileges too as the authorized_submit_users setting in postfix has similar result.