not be able to send via SMTP
A little tricky but possible.
1) If he is using his own laptop, (eth0 or wifi), and picking up dhcp from your network, determine exactly his mac address
2) Edit the configuration file on your dhcp server (/etc/dhcp.conf) to always assign the same IP to his computer.
3) Edit the /etc/mail/access on the mail server to deny RELAY for that IP.
On the other hand, I'm curious to know if there is a way from within scalix (SAC or not) to *deny authentication* unless the user accesses email via SWA. After all sac Advanced configuration for each user has a feature to enable or not the use of SWA. That is the reverse of what is being asked, but would provide an elegant way to do it.
Jaime