Restricting SMPT Sender on account basis

Hello, I have a customer on my WHM Server who is undergoing a spam attack.. We've subscribed to ProofPoints content filtering service & have updated the MX records for that customer so their mail flows through the spam filtering service before it comes back to us. This worked great, for about three weeks... Now, the connections are coming directly to the server and it's delivering the spam emails to the users' inboxes. I only have 2 customers out of approx. 140 customers using this spam filtering service. Is there a way to create a rule, on a by-domain basis to restrict connections for that customers inbound email to flow in ONLY from the IPs of the Spam Filtering service? Any help would be greatly appreciated! I am on WHM 90.0.9 also running MailScanner & CSF Thank you!