If you want to do this with a single Connection Server, then you'll have the same IP Address based "PCoIP External URL" for both internal and external users. This means that the same IP address for the PCoIP connection will be used by internal and external users. The only way you can do this is if you allow the internal users to connect to the Connection Server on this same IP address.
Doing it any other way will require you to either deploy a Security Server, or deploy additional replica Connection Server. Either will work.
Mark.