[Exim] bounces through different server and not smarthost?

Well, after scouring the archives and google, I'm resorting to the
list...

I have my own domain and receive mail directly to my box. Due to the
fact that my dynamic IP is on various RBL DUL lists, I configured my EXIM
mail server to use my ISP's server as a smarthost. This works *almost*
perfectly. The problem is that they don't handle bounces correctly:
(sanitized / stripped version of conversation:)

220 out003.XXX.net ESMTP server (InterMail vM.5.01.05.33
EHLO xxxxx.com.
250-AUTH LOGIN PLAIN.
250-8BITMIME.
AUTH LOGIN.
334 XXXXXX
XXXXXX
334 XXXXXX
XXXXX
235 Authentication successful.
MAIL FROM:<> SIZE=2889.
RCPT TO:<XXXX@???>.
DATA.
250 Sender <> and extensions (SIZE=2889) Ok.
550 relaying mail to XXXXX.com is not allowed.
503 No recipients specified.
QUIT.

I'm authenticated, so it should relay already.... Something is broken
where the <> sender is messing up the relay checking.

Anyway, My ISP (like most) is not responsive on getting their server
config fixed, so I am looking for a way to NOT use the smarthost for
bounces only. I'm using Exim 4.20 from Debian Sid.

So I was thinking I could just have a "bounce_smtp" transport, but am a
little onclear on how to setup a director / router to identify and
route bounces to the bounce_smtp transport.

Any suggestions? examples?

Thanks!

- Walt