[exim] How to restrict smtp connections to just authenticate…

Hi, I'm far from an expert on this subject and I hope someone can answer my
question...

We are using anti spam appliances to send mail into our servers. I'd like to
restrict all inbound smtp communication to authenticated users and the anti
spam appliances so that all other smtp traffic is refused.

We have found that although the appliance does a great job, some spam still
gets through because it is being sent directly to the server instead of via
the domain's MX records.

One obvious way of doing this would be to use...

local_interfaces = 127.0.0.1
daemon_smtp_ports = 2525

And tell all our users to change the port in their email software. Then
restrict incoming access to port 25 via iptables.

I'd rather find an alternative that doesnt require our users to make any
changes.

I was hoping that there could be an easy way of doing this in the exim
configuration using and ACL or something.

Is it possible ?

Any help, greatly appreciated!