What I want is that all emails sent to/from user1@example.com got copied to user2@example.com. The configuration solution must avoid be modifiable by user1 (due to I think that whatever solution that include filter creation in the user1 account don't apply, at least I can create a filter in user1 account that he can't delete), and if that configuration is hidden from user1 better.
How to copy incoming and outgoing email to another account in Google Apps?
gmail;email;google apps
Here is the doc to do that.The Content compliance setting enables you to specify what action to  perform for messages based on predefined sets of words, phrases, text  patterns, or numerical patterns. The content compliance setting scans  messages for content that matches one or more rules that you configure  within the setting. You can choose whether these messages are rejected  or delivered with modifications -- for example, to notify others when  the content of a message matches the rules that you set.