To limit certain users to access CRM from public

Hi all,

We are having on-premise 2015 update 1 (using AD single sign on), wanted to allow only certain users to access from public. What are the options we have?

Will CRM with Internet facing able to control certain users to access from public? 

Thanks In Advance