You don't say which version and build of OpenSSL (which determines the ciphersuites available, and also protocols although protocol isn't your problem here) or Ubuntu release (which effectively determines the above), but from the sourcefile in the error message it's clearly 1.1.0 or higher, and that normally doesn't support any of the ciphersuites offered by your XP3 client. If the client varies depending on the Windows it's running on, probably it's using schannel, and XP/S03 (even with SPs) didn't do any ciphers better than 3DES (confirmed in your ClientHello dump).
Easiest out would be if client can do clear-SMTP (no TLS) and you configure postfix to accept that; as long as this server is only used for that one lame client the security risk isn't much worse than that client already is. Failing that:
(I'm pretty sure) you can download the (OpenSSL) source package (i.e. as already patched/tweaked by Ubuntu) plus buildeps and buildtools, change the config step to add --enable-ssl-weak-ciphers, and rebuild and install; this should be compatible (and now support 3DES, included in MEDIUM), although personally I wouldn't chance it if anything important runs on the same system. Otherwise you either must build your own OpenSSL version and your own postfix using it, or assuming you are using implicit (465, not STARTTLS) put something (simple) in bewteen, like a back-to-back pair of stunnel built with a weakened version of OpenSSL, which is probably simpler.
OR just use a Ubuntu closer in age to XP, like 16.04 -- which I happen to have on WSL for testing, and has OpenSSL 1.0.2g-plus-patches
which does support 3DES (and TLS1.0 -- all OpenSSL since before 0.9.8 does that). If you don't want to dedicate a system for this put it in a VM or docker or similar. Which incidentally might also help prevent it causing panic if your organization does network-wide scans for obsolete or vulnerable versions of things.
