exclude client from smtpd_tls_security_level = encrypt

[btb]

i have an msa, which requires encryption and smtp auth, save one sole 
exception - a client which [for now] cannot perform either, that i must 
explicitly trust based only on source ip address.  to that end, i've 
allowed it to perform submission with check_client_access, but i'm left 
at odds with smtpd_tls_security_level = encrypt.  i'd like to say 
"smtpd_tls_security_level = encrypt, with this exception".  something 
akin to smtp_tls_policy_maps, but for smtpd?

for the moment, i've done
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes

which suffices, but not quite in the manner that i'd prefer.

can this be done?

-ben