I've set up a Win2012R2 RDS Session Host farm.
Only some users must be allowed to log on outside our network (external) while everybody must be allowed to logon on internal network.
How can I do this?
One method would be to use a Remote Desktop Gateway. The Gateway can be fitted with multiple Connection Authorization Policies and Resource Authorization Policies (CAPs and RAPs) to define exactly who is allowed to connect to what. You could, for instance, create an Active Directory security group named "Internal Network Access" and assign that security group to the RD CAP/RD RAP that defines access to internal resources.