I am trying to make postfix not to auth users on port 25 but only on 587 and using STARTTLS. I have tried may different confs, but no success so far.
And remove smtpd_sasl_auth_enable = yes from your main.cf leaving the default no.
This requires TLS for all submission (port 587) connections.