You will need a custom firewall rule. With Custom Firewall rules you should always try them at the command line first in case they are wrong. An incorrect rule entered through the webconfig can cause the firewall to go into a restart loop. If this happens you have to be comfortable with editing the file /et/clearos/firewall.d/custom from the console, in case you need to delete the rule. I prefer the nano editor over vi.

You will need to leave in place your current port forwarding rule. Then, at the command line try:

iptables -I FORWARD -i your_external_interface ! -s your_external_filtering_service_IP -p tcp --dport 25 -j DROP.

If that works, change "iptables" to "$IPTABLES" and use the command in the Custom Firewall. It will only work for a single IP or subnet. If your provider uses multiple IP's, then it gets a bit harder.