only allow inbound msgs from hosted spam filtering service

Please pardon my exim newbieness and forgive my ignorance...

We host a number of clients' e-mail on a dedicated server. We use a 3rd
party hosted spam and virus filtering service for all e-mail domains we
host, so all of our clients' domains' MX records point to the filtering
service's SMTP server which forwards filtered mail to our server.

To my chagrin, we also allow our clients to use our server as an SMTP
relay, provided they authenticate. Not ideal, but ok.

My understanding is that if someone who's using our server to relay
mail sends a message to another user who's domain we host (same or
different domain as sender), the mail will be delivered directly to the
recipient's mailbox, rather than being forwarded to the our spam
filtering service's server as per the recipient domain's MX record.

Here's what I would like to have happen:

1. Only accept inbound e-mail for domains we host if sent from one of
the the spam filtering service's SMTP servers.

2. For all relayers, if they attempt to send to a mailbox on our
server, force the message to be passed to SPAM filter services SMTP
server (which should be in the hosted domain's MX record anyway) so
that it will be filtered before we accept it on our server.

Does this make sense?

TIA for your suggestions.