Right, first I mis-read this question and wrote a general (non refined) guide that you can read a bit lower, just in case I mis understood and that is what you are trying to achieve. After re-reading, I wrote:
If this is a pure internal intranet and there will be no connections from outside the network, there is no way to really control access at the router, unless you put in another router between the intranet machine and it's connection, which I really wouldn't recommend.
Routers typically only firewall connections going from one interface to another (Internet <> Lan) and they do not filter internal connections (Lan <> Lan), I would recommend using a basic software firewall (such as the one built in to Windows) and setting it to strict - only allowing port 80 from selected connections, you can also use Apache/IIS to only allow connections from certain IP ranges.
This depends on your network topology and without knowing more, it is hard to help.
Typically, you will need a router that supports two connections such as a Draytek Vigor 2820 (Many others - Google 2nd Wan/redundant wan etc.).
However, unless you have some sort of bound connection (when from the same ISP), these two connections will have different IPs and anyone connecting in to your intranet will only be via one of the connections so you need to set the rules there.
(I was going to write more before I realised I was on the wrong track... If I was going correct, let me know and I will continue).