[exim] Allow/Deny messages based on Sending IP ?

Hi,

I have a mail server which which accepts messages for a number
of domains. The domain MX's first point to a gateway machine
which scans for viruses and SPAM.

How do I tell Exim on the final server to only allow messages
from (a) the gateway machine, and (b) the client IPs so they
can send mail out - these are already stored on a file.

Most of the messages should follow the MXs through the gateway
but some viruses try the hostname directly, and I can't firewall as
the IP list is dynamic.

Can anyone assist?
Thanks,
Adrian.