How to restrict outgoing email as well as external web access for certain users?

In our use case, we need to block outgoing email for some users, meaning that these users can only send email within the company, they can't send email to an external domain.

Another requirement is to restrict external web access to the Zimbra server, only a few users is allowed to log onto Zimbra server from external IPs, while all the other users can only access Zimbra from within our company LAN.

Are those two configurations possible with Zimbra? If yes, it'll be highly appreciated if someone can provide a how-to guide.