Each time a user wants to relay from an IP Address unknown to the system, she adds the IP to the relay net, restarts the SMTP server and sends her mail. After messaging is done she removes the IP and restarts the SMTP server once more.

This is by far the most insecure solution. Though possible, you would have to permit shell access to users and teach them how to deal with the system. It won't work for those who focus on the computing and not the computer...

A service/script runs on the SMTP server that will add IPs of users that have successfully authenticated to their POP3 or IMAP server. The service/script will write the IP of those users to a file or database. Since they are valid users to the pop/imap server they must also be valid users to the SMTP server. When they send messages after the pop/imap the SMTP server also looks up the file or database that the pop/imap server has written to and if the IP is found in there the client may relay messages. After a certain period the IP expires and is removed from the file/database.

This will not work easily with common Mail clients, as not all of them come with built-in support for SMTP-After-POP. There are workarounds on the net, but solution may require expensive configuration and/or constant support.

This approach uses a totally different, IP independent method. Instead of checking the IP of the Mail client and comparing it to a range of permitted IP Addresses, the Mail client authenticates itself providing username and password to the mail server (or sharing a secret with it). These credentials are compared to a source that the mail server has access to and if valid data has been provided, the mail server will permit relaying.

This HOWTO will help you to enable Postfix to provide SMTP AUTH using Cyrus-SASL©. Read about the benefits of using SMTP AUTH and how SMTP AUTH is being processed before you will find out what steps you will have to go to deploy your specific SMTP AUTH solution.