Intranet Access

I have my main server sitting behind a proxy server. My webserver sits on the outside and uses pw authentication to access the intranet which resides in the same place

How do I restrict a user, let’s say joeuser, from accessing the intranet from outside the plant…in other words, joeuser is able to access the intranet from inside our building but if they would try from home, they would not get through.