Switch Domino SMTP to authenticated for relay procedure?

I've always had Domino setup to not allow any relay and also put it
behind a Sonicwall Email Security (SES) device. Any user outside the
firewall had to use a Notes client on their PC or DWA to access/send email.

Now the company wants to use a couple of smart phones with email. The
SES doesn't support authenticated SMTP but I can configure the smart
phones to use port 587 and authenticate, the firewall to forward port
587 to Domino instead of the SES, leave port 25 going to the SES and
have the SES forward all cleaned email to Domino on port 587.

What I am not clear on, and need a document or FAQ that spells out how
to change Domino to accept relays from any IP _only_ if they
authenticate *OR* everything else from the SES's IP without authentication.

Also, I will need to make sure that the smart phones only retrieve new
emails via POP3 and leaves them in the Domino mail file for when the
user gets back to their desktops. The users tend to keep a lot of
history, some in folders, some in their inbox.

The phones are running Windows Mobile, so some of the usual email client
features (like setting a custom reply to address or auto BCC all sent
email) are missing. After their trial period is over they may look at
add-on email clients so any suggestions on the best (and cheapest) would
be helpful.

Thanks

Roger Vicker, CCP