Thanks,
It works for me now.
The error "550 5.7.1 Client does not have permissions to send as this sender" is because our SMTP back-end did not accept SMTP relay from NGINX. Configure SMTP backend allow NGINX relay fix my error.

I used xclient-> on, when I try to auth login, SMTP backend return error with code "500 5.3.3 Unrecognized command" like my SMTP does not support xclient ( I guess)

Thanks
Tan