For 2007 I would recommend either Trendmicro Scanmail or MS Forefront.

As you can load multiple scan engines into forefront I think that is the best solution and gives nearly bullet proof performance in terms of new threats.

What do you mean by BES virus scanning? Do you mean on the handheld or on the bes server itself? Virus scanning on the exchange server should be enough to protect email flowing out through through the handheld.

To protect the bes handheld use a security policy that does not allow the user to install software. That will prevent anything from infecting the handheld.