nadia678 & Charlie
I was referring to the Email panel in server manager where access can be set for POP, IMAP & Webmail.
I was not strictly answering the question of blocking port 25 as I assumed that was not really what nadia678 wanted to do.
The question as posed, was somewhat contradictory.
The question I answered was really just the part that said...
...I want the users to be able to send mail from the internal card and users to use webmail from the outside...
So the practical answer to achieve that without disabling the email system (smtp and/or port 25), is not to block port 25, but to disable POP & IMAP (ie Allow access only from local networks) and enable webmail (ie Allow HTTPS (secure)), which can be done in server manager.