Configure users for internal mail routing only

You should be able to use Transport Rules to do that. Make sure those groups are Distribution Groups (they can eventually be hidden from Address Lists).

To forbid sending E-mails outside of Exchange, create a rule:

• if sender is member of group2
• and message is sent outside the organization
• then drop the message
• and send NDR with status code (choose code and message)
• 
  

To forbid receiving E-mails from the Internet:

• either use the same principle (if user is member of group2 and sender is outside the organization, drop with a custom message
• or in the delivery options for those users, only allow messages from authenticated users
• you can make exceptions, for instance if you have custom applications sending messages directly to Exchange
• 
  

For group3, then

• create a rule that forbids sending to member of a distribution list when sender is member of group3
• and send NDR etc

Link:

http://social.technet.microsoft.com/Forums/en-US/aeece703-a5b9-40ff-9ec1-e2977f7d6a56/how-to-configure-users-for-internal-mail-routing-only