Protect confidential documents from internet

In our application server we have lots of classified documents, for an example- Public, Private and Confidential documents. The application is accessible from internet and intranet, so we have to protect(deny) the access for Private and Confidential documents only from internet. What are the possibilities there and which is the right way to do this.