Firstly, this is not an intrusion directly - this looks like simplest port scanning... And excepting certain flood on (postfix) ports, and probably an announcement of apps or rather the ports your server listening to the scanners side), you'd have no troubles with that.
You can surely ban them, but you must know what you do (e. g. to avoid false positives for some legitimate users of you, for instance if slow connection of someone would cause the same messages)...
To ban exactly this flood on postfix-side only, you could add this jail:
[postfix-scan]
filter =
failregex = ^\s*\S+ postfix/smtpd\[[^\]]+\]: lost connection after (?:STARTTLS|UNKNOWN) from [^\[]*\[<ADDR>\]
port = smtp,465,submission
... (logpath, backend, maxretry, findtime, etc) ...
enabled = true
(just as already said you could theoretically ban some legitimate user with that, so maybe you should increase maxretry and decrease findtime for this jail)
To ban port-scanning cardinally you could add some net-filter rules for example logging (and probably dropping) connections sending SYN packets to many ports (with some burst) or even on some packets to some closed ports.
And then you can even ban them additionally using something like - https://github.com/fail2ban/fail2ban/issues/1945
