Looks rather complex, and it seems that the restricted users would need a different email address to everyone else? So
fulluser@company.com and
restricteduser@internal_company.com or something like that, but perhaps I'm reading that part wrong.
Either way, surely a tickbox in the user account, "Permit external email" would be so much better, many companies would like all staff to have an email account to recieve company notices etc, but may not want all staff sending external email all day long, the ability to turn on/off external mail on a per user basis sounds like something people may use.