We dont want to block all HTML emails, but just ones that use javascript, or attach javascript, or anything to do with javascript. Is there a way to do that right at the server?

Always test your pages using Google’s own tools and third-party resources to view the rendered HTML to make sure all your content is showing up.