I've never used OpenSMTPD, but SMTPD.CONF(5) seems quite helpful. There's even an example on how to configure a server to reject messages unless they are from IP addresses listed as other relays.
Sites that accept non-local messages may be able to cut down on the
volume of spam received by rejecting forged messages that claim to be
from the local domain. The following example uses a list table
other-relays to specify the IP addresses of relays that may
legitimately originate mail with the owner's domain as the sender.
table aliases file:/etc/mail/aliases
table other-relays file:/etc/mail/other-relays
listen on lo0
listen on egress
action "local_mail" mbox alias <aliases>
action "outbound" relay
match for local action "local_mail"
match for any action "outbound"
match !from src <other-relays> mail-from "@example.com" for any \
reject
match from any for domain example.com action "local_mail"
The match for any is quite liberate and requires the match !from src <other-relays> to limit it further, but as you requested a single configuration line, you could take the opposite approach. E.g. if you want to whitelist i.e. allow unrestricted relay from 198.51.100.10, you could:
match from src 198.51.100.10 for any relay
If it doesn't work directly, you might need to specify the simple relay action first:
action "outbound" relay
match from src 198.51.100.10 for any action "outbound"
That's:
match options action name
If at least one mail envelope matches the options of one match
action directive, receive the incoming message, put a copy into each
matching envelope, and atomically save the envelopes to the mail spool
for later processing by the respective dispatcher name.
[!] from src address | <address>
Specify that session may only originate from string or list table address which can be a specific address or a subnet expressed in
CIDR-notation.
[!] for any Specify that session may address any destination.
action name method [options]
relay Relay the message to another SMTP server.
