Is there a way to disable recursive queries by the DNS hosted on the server while still allowing for DNS queries originating on the server to work?
Not with Microsoft's DNS server, there isn't.
With ISC's DNS server, BIND, one could bodge things with views. Microsoft's DNS server has no such mechanism. So for any given instance of Microsoft DNS server, one has to choose whether it is a public content DNS server or a site-local proxy DNS server. It cannot bodge things and pretend to be different kinds of server to different DNS clients.
The security testing service/tool is quite right. It is best practice to not provide proxy service — any kind of proxy service: be it HTTP proxy service, DNS proxy service, or SMTP Submission service — to the rest of Internet outwith one's own site. You very much should have separate servers: a content DNS server publishing your public DNS data, about your domain names that you have registered, to everyone on Internet; and a local proxy DNS server, that does the grunt work of query resolution on behalf of your LAN's/organization's computers, that is only accessible to machines at your organization/on your LAN. With Microsoft's DNS server, this isn't particularly easy.
It would be especially difficult if your machine were also a domain controller. You state that this machine is directly reachable from the whole of Internet. If such a machine is a domain controller, then you should re-think your network organization now. You'd be exposing an awful lot of internal services to the public, not just proxy DNS service. So let's work on the presumption that this isn't a domain controller.
Since it isn't a domain controller, and is merely a member server, you don't have the requirement that the DNS client on the machine should use the machine's own DNS server (or, initially, another domain controller's DNS server) for proxy DNS service, that is the case for domain controllers. If you had, you wouldn't be able to turn off proxy DNS service on the machine's DNS server. Fortunately, it isn't a domain controller, and its DNS client can use some other machine for proxy DNS service, not itself.
The DNS client on the member server machine still has to use an internal proxy DNS server, though. You cannot just point it at some external DNS server like those provided by your ISP, Google, or any other party that doesn't know all of the DNS data that Active Directory is using on your LAN. You can point the machine's DNS client at the DNS server on one or more of your domain controllers, though. This is fairly simple, and is what you are — after all — already doing on all of your workstations on your LAN. The DNS client on your member server need merely be configured like the DNS clients on all of your workstations are.
Given that your machine's DNS client isn't using the DNS server running on the machine for proxy DNS service, you then simply configure Microsoft's DNS server to not provide proxy DNS service of any form to anyone.