I figured out how to do it. You do the following..
1. Create a group called InternalOnly and add the users that you do want sending/receiving external emails. This group has to be mail-enabled.
2. Create a Recipient Policy taht gives them a fake SMTP address i.e @fake.domain.domain. Leave the X400 addres alone, so they can recieve internal emails.
3. Go to your SMTP internet connectors, choose Properties. Choose the Delivery Restrictions tab and under Reject add the group. Do this for all connectors.
4. Follow the steps in the MS Q277872 (this an article on the Connector Delivery Restictions not working correctly.)
That should fix it. Thanks for all your help though.