[exim] mandatory SMTP AUTH except for one MTA peer

I'm running exim4 on Debian (Etch) machine, so far I have virtual users in MySQL
database and courier packages for SSL POP3 and IMAP access. Users are
authenticated by courier authdemon. Right now everyone (both MTA and MUA) is
allowed local delivery, but only authenticated users can relay.

My problem:

I need to configure following:

1) mandatory authentication: local mail delivery _and_ relay will be allowed only if
user authenticates, in fact this means MUA access for authenticated virtual users only)

2) one exception is required - there will be specific MTA peer, which will work as
smarthost for outgoing e-mail and also as a "hub" for incoming e-mail (well, actually
it can be described as "bi-directional" smarthost.) It is special security appliance,
providing antispam and antivirus scanning. This appliance can't act as SMTP
AUTH + TLS client, so I need to set exception for it and allow it non-authenticated
local delivery. This is the only way my virtual users will be receiving e-mail from
outside world.

Thanks in advance for any configuration snippet example (or at least hint how to set
this up).


Vit