[CentOS] what should I do?

Dear All,
a friend of mine who has a small office want to have a configuration 
like this:
* around 3 people can have full access to internet
* around 1-2 people can just have email access (can send and receive
   email to any address)
* the rest of the people in the company just can have internal email
   (can send and receive email just to/from the peer - on the same
    domain).

I think I can use the squid to prevent the access using the browser, but
what should I do to set the email configuration like that?
I think I can install qmail for the MTA, but I don't know how to prevent
several person just can send/receive email from the same domain, while 
the other can send/receive email to any address he wants to.
Anybody kind enough to share how to do that?
Thanks in advance for you help.

-- Tanu --