The trick was to change the relay connectors to be only Tls for Auth and Permission groups to be anonymous and exchange servers. Wtih the shell the following command worked:
Get-ReceiveConnector -Identity "connector name" | Set-ReceiveConnector -AuthMechanism "Tls" -PermissionGroups "AnonymousUsers,ExchangeServers"