How to allow users to acces RDS internally, but not externally

Hello,

Currently we have set up an RDS 2012 Infrastructure where it is accesible either internally and externally.

The thing is that, for a particular set of users, we need them to access RDS internally, but we can't allow them to access it externally.

Is there a way to achieve this?

Thanks.