If you insist in doing it with a virtual alias account, here's the tutorial. it mentions the "Access Policy":
https://docs.iredmail.org/sql.create.mail.alias.html
A better solution is subscribeable mailing list. Of course you can disable the subscription, but it's easy to control who can send email to the list.
FYI: https://docs.iredmail.org/manage.subscr … lists.html