[Exim] internal routing only ACL

I have a list of aliases (file called aliases.internal) that I don't
want to allow incoming external mail to reach, just internal. Does
anyone know how to configure exim (maybe something in the
system-filter?) to do that?