[exim] how do I block mail to local domains except SMTP auth…

New to exim and have not found this in the FAQs or online resources so far.

We have a machine with several domains. The MX record for these domains
is pointed to a spam filter appliance.

Alas, spammers don't play fair. They choose to connect directly to the
IP address(es) of the domains on the box and still send their spam that way.

While a firewall solution might seem the logical choice, it isn't here.
The reason is that the users in each domain need to be able to see
mail.abc.com or mail.xyz.com as their outgoing SMTP server which they
relay through via SMTP auth.

So, I need to know how to disable the ability to receive mail for local
domains EXCEPT from a trusted source (the spam appliance box). Further,
I need to allow SMTP AUTH clients to relay mail through their respective
domains.

A firewall simply shuts off all SMTP traffic including SMTP auth unless
I know all the "trusted sources" which is basically moot given roaming
customers.

How can this be done?

Also, it would be preferable to be able to do this on a domain by domain
basis rather than server wide. If it can't be done that way, server
wide is still better than what we have now.

Thanks for any tips or advice you can offer.