You do this with the configuration optoin
It requires the user has SASL authenticated.
smtpd_sender_login_maps (default: empty)
Optional lookup table with the SASL login names that own sender
(MAIL FROM) addresses.
Specify zero or more "type:table" lookup tables. With lookups
from indexed files such as DB or DBM, or from networked tables
such as NIS, LDAP or SQL, the following search operations
are done with a sender address of user@domain:
This table lookup is always done and has the highest precedence.
This table lookup is done only when the domain part of
the sender address matches $myorigin, $mydestination,
$inet_interfaces or $proxy_interfaces.
This table lookup is done last and has the lowest precedence.
In all cases the result of table lookup must be either
"not found" or a list of SASL login names separated by
comma and/or whitespace.
Then you add a configuration option along with the above to the smtpd_sender_restrictions optoin such as;
smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch