[exim] Setting up exim4 to prevent relaying

I've been using exim4 for what seeems like forever, and never had an
issue. I just moved to a new server, and rather than try to migrate my
existing (very old) configuration I need to start from scratch. It's been
a number of years since I've had to muck about in exim config. It's been
very stable.

The setup I need is very simple:

To relay through the server:
Users on the local lan need not authenticate but can
Users outside the local lan must authenticate

I am having a very hard time getting this going. The server sits behind a
NAT'd firewall. It's getting packets but all I see is one packet to the
server and an immediate packet back from the server, and the client says
"Couldn't open connection to the server". Since my clients ATM that I
have available are all smartphones I don't have debugging for the clients.

There are no errors logged to the log file.

Is there a really basic HOWTO on how to set up anti-relaying measures?

I've tried SSL, TLS, etc. and no joy.

I need a real bonehead guide, I guess.