Limiting External connections

I have been directed (by management) to find a way to limit some of our users from sending email (via Exchange 2003) to external addresses. These machines/users already have the internet either heavily filtered or disabled, but we do not want email sent from corporate accounts by these users (there is no business justification for them to need this access). Can I do this by simply filtering or disabling the user’s SMTP access, or is there a better way?