IFD but restrict external access - use only exchange online connection

Hi, we have a CRM 2015 RTM, we want to use our Exchange Onlin mailboxes so we are thinking about setting up IFD however we do not want to allow access to CRM from external location.

What's the best way to do this? Is it a matter of not setting up the external IP/DNS entry or would that nter with the Hybrid Exchange Online connectivity?

Thanks