[exim] Help with an ACL

Hello Exim users,

I've some relays for antispam/antivirus and the MX record for all domains
(hosted in other servers) changed to go through those servers.
The problem is that some spammers sends mails directly to the A record of
the domain (that is on other server) so those mails aren't scanned.

So I want to create an ACL to deny incoming mails that aren't from my relays
or from users that aren't authenticated (with SASL or POPbeforeSMTP).
I've done this:

acl_smtp_rcpt = check_recipient
...
begin acl

check_recipient:
        accept  hosts = :
        accept
                authenticated = *
                endpass
                message = $sender_fullhost is currently not permitted to \
                        relay through this server. Perhaps you \
                        have not logged into the pop/imap server in the \
                        last 30 minutes or do not have SMTP Authentication
turned on in your email client.
                condition = ${perl{checkrelayhost}{$sender_host_address}}
                endpass
                message = $sender_fullhost is currently not permitted to \
                        relay through this server. Perhaps you \
                        have not logged into the pop/imap server in the \
                        last 30 minutes or do not have SMTP Authentication
turned on in your email client.
                hosts = +relay_hosts
....

I don't know if I can use two "endpass" in the accept...Is correct this ACL?
If not...how I could do this?

Thanks.

Regards,
Alvaro.