[exim] Mixed authentication

I'm trying to figure out how to set up exim to use authentication on
outgoing messages for one port and use unauthenticated otherwise. The
current configuration accepts connections on port 25 and allows relays
from internal networks to the outside so that internal clients can send
outbound. The internal machines that also happen to run exim use the
server as a smarthost (a few other machines with only mail clients use
the relay function). I want to leave that portion working as is but
open up an additional port for SSL/TLS authenticated sending so that
clients outside of the internal network can send email through this server.

Thanks