I'm still not 100% clear on whether spampd is calling spamassassin or spamc, if it is calling spamc you need to set
allow_user_rules to 1, if not, it should look for the user_prefs in the directory of the user calling spamassassin, and that directory only.
I don't think you will be able to use individual user_prefs from in spampd, they specifically mention that per-user whitelists are not available. They also mention that per-user preferences are a To-Do..
From the notes on switches
Turns on the SpamAssassin global whitelist feature. See the SA docs.
Note that per-user whitelists are not available.
From the To-Do section on github
Per-user preferences: The jury is still out on this one. I'm thinking
more and more that most per-user prefs should be specified on the
final mailbox server. Why? Because SMTP isn't designed with per-user
preferences in mind. On a relay server, the same message body can go
to multiple recipients who may have wildly different preferences when
it comes to handilng junk mail. The exception here might be the use
of LMTP protocol, which bears further investigation.
I'm guessing they assume the users will have .procmail filters.