Deny SASL authentication not from local IP

[Неворотин Вадим]

How can I deny SASL authentication not from local (192.168.0.0/16) IP? Now I
have restrictions in smtpd_recipient_restrictions and other parameters,
which allow send mails to relayhost only from local IPs and only after
authentication. But client from Internet still can authenticate on my
server, but can't send mail. But I need to deny authentication from outer
net at all. It's because my users use very simple passwords, and in my net
each user has only one login/password for all services.