Segmentation is the key technique here.
You never work with sensitive data and external data at the same time. Depending on the sensitivity, you may use a different device that may be air gapped from the external world, but often just a device with mandatory VPN, or a different virtual machines, or SELinux context (hint: SELinux was developed by NSA). Even further employees that handle data from the public are different from employees that handle sensitive data, employees that handles hiring doesn't really need to have access to investigation data, for example and vice versa.
There is usually a procedure to transfer data between sensitive zones, with check and controls about what kind of data can be transferred under what conditions. This is often enforced through some form of MAC (mandatory access control).
Emails are often segmented as well. The mail server may automatically strip attachments from emails by people outside the agency's trusted environment, and they may be automatically tagged for work in untrusted context. You may have internal mailbox that's separate from public mailbox. There are often a form of content filtering in email server and/or client, through antivirus check and/or some form of document classification and protection system.
But most importantly though, security is mainly about human. Regular security drills, practice on detecting phishing, documented procedures, and classifying documents, all works to prevent attacks. Many security vulnerabilities depends on human factors. Software and tools can help prevent errors and make enforcement easier, but ultimately user training is the most important way to protect any system.
I wasn't able to find a publicly available document of email security practices for US government agency, but here's one for Australia. In particular, you may be interested in Page 182 Email Security and Page 190 Email Content Filtering. Other sections that may be of interest is Page 282 Data Transfer and Content Filtering.