Within your Postfix configuration, you can use the setting
smtpd_recipient_restrictions in order to decide who should be able do use your server as a relay.
For example, in my config it looks like this:
That means that every one from my network (see also the
mynetworks setting) and everyone who is authenticated can send email. Simply remove
permit_mynetworks, and nobody will be able to send email without authentication anymore. Just be aware that this might break other programs that currently rely on being able to send you email without authentication, and not just your PHP application.