[exim] Blocking HELO with IP, but not for autenticated users

Hi, list!

Another problem: I'd like to block the HELO/EHLO with IPs or not FQDN, but I
MUST allow this for all my autenticated users...

I want to reject these E-Mail as soon as possible.
Has Exim an ACL that be called after "MAIL FROM"?
If yes, then I can reject the E-Mail with invalid HELO/EHLO and not
autenticated direct after MAIL FROM...

Thanks
Luca Bertoncello
(lucabert@???)