Thanks for the input, Steve - much appreciated. I think I am beginning to understand how it all fits together and I like it!
According to the admin settings, it is possible to limit by trust level who gets to reply to staged users.
Also, it is possible to set up the incoming mail to post to a category (I think) or to personal messages with a group. I prefer to do the latter, which limits the risk somewhat because I can work with my team on how to deal with these messages.
That said, I am still a bit sad that the emails staged users get doesn’t ‘look more like an email’ so these people we do reply to don’t mistake our messages for linkedin style spam, but still has some vestiges of discourse styling - but @codinghorror has indicated that changing this is more effort than it is worth.