SIP trunking with IP validation

A friend of mine wants to send traffic through our system so we need to create a sip trunk that accepts his calls. Unfortunately he can not send username or password so we would have to authenticate his calls by the originating IP address. Is this possible at the trunk level? If yes how would it be done?

I tried already several scenarios in the trunk PEER but nothing seems to be working. The INCOMING section appears to be ignored in this case.

e.g.
type=peer
host=xx.xx.xx.xx
insecure=yes
fromdomain=yy.yy.yy.yy
disallow=all
allow=g729
transport=tcp

Basically I would need
deny=0.0.0.0/0.0.0.0
permit=yy.yy.yy.yy/0.0.0.0

but that does not seem to work either. Can this be done? Any help is appreciated.