Managed relays are now authenticated by default, so the relay capacity you pay for is only ever used by your endpoints.