[exim] SSL questions

I'm trying to get exim setup so that if someone connects on port 25 it is a
standard connection (and does not offer TLS) but if they connect of a
different port it does offer TLS to everyone - and in fact mandates that TLS
is used on this port (so if the client does not STARTTLS the connection is
refused)

Further from that, I want to get different authentication methods depending
on if the connection is encrypted or not. The SPA auth can be used over
either connection, but plain can only be used if the session is encrypted
with TLS

Can someone point me in the right direction on this.

Thanks,
Keith.