Hi ,
Based on my experience whenever an user from external world try to access the owa URL from the external world will be forwarded to a firewall .So on such case we can create a rule in a firewall to check the access for OWA from external world.
Step 1:
Create a active directory group in AD .Then add the users to the group that you would like to provide the access for owa from the external world.
Step 2 :
Then on the firewall just create a web publishing rule for owa which would check group membership for the owa access from the internet .
So on such case "hourly users" can able to access owa only on the LAN network and not from the
internet since they are not an member of the Security group which is mentioned on the rule created in firewall.
Please reply me if you have any queries.