Locking any ordinary app should work OK. Locking basesystem packages can cause trouble. I habitually do upgrades with multiple locks in place. I can’t imagine locking mailman would be any serious problem, but you might wish to contact mailman’s maintainer for a recommendation.