Absolutely, you can do this with a message filter, and AFAIK it shouldn;t matter what the container type is as long as it's assigned to the correct user.

Though you could accomplish this with message filters, my vote would be for using ldap group query with the incoming mail policy. You can have the Media-policy that checks if the recipients are a member of the Media group. If recipients aren't members of the group, they will use the Default policy. This is called message splintering by the way.

Then, once things have splintered into their appropriate incoming mail policies, you can have incoming content filters that drop the media attachments for the default policy while the Media policy allows them through.

Have you tried to create a policy allowing these file types and checking the recipients using LDAP group query ?

Then, insert a policy below this (the mentioned above) not allowing these file type for non-group members.