How would you deploy TE250X Check Point appliance just for email traffic and in-line mode without a Check Point Security Gateway?

A SPAN port deployment is out-of-band rather than true in-line, and using MTA mode on a SPAN port is not a supported standalone TE250X configuration for this use case.

While the TE250X does support MTA mode, fully standalone in-line email inspection without any gateway integration is not a supported Check Point on-premises architecture for this appliance.

The TE250X on-premises SandBlast appliance requires a Check Point Security Gateway to intercept and forward email traffic to it for threat emulation in an in-line deployment. Without a gateway to perform this redirection, the TE250X cannot be placed in-line for email independently. Check Point's cloud-based threat prevention services are the supported alternative that handles email inspection without requiring a local gateway.

This is incorrect because the scenario is achievable - just not via an on-premises TE250X appliance. Check Point Cloud Services satisfy the requirement of in-line email inspection without a local Security Gateway.