Postfix – Different Header Checks for Incoming and Outgoing Mail

As you have understood that to apply options in master.cf to override options in main.cf on a per-port basis.

To achieve your goal you want to place the restriction as smtpd_recipient_restrictions rather than smtpd_client_restrictions. The key is to reject_unauth_destination instead of just reject:

mydestination = aardvark.com, acme.com 
smtpd_recipient_restrictions = permit_sasl_authenticated,reject_unauth_destination

This prevents an unauthenticated client from sending to any domain you're not responsible for. In this context domains you're responsible for are more than just mydestination. See reject_unauth_destination in the manual.

As described in access(5), just add a check_recipient_access map to your smtpd_recipient_restrictions; if you wish to block these recipients for your own users too, make sure to place it before permit_mynetworks and/or permit_sasl_authenticated.

smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/bad_recipients, permit_mynetworks, reject_unauth_destination, permit

And in /etc/postfix/bad_recipients:

bad_user1@example.com REJECT We don't like him
bad_user2@example.org REJECT Delivery to this user is prohibited