Hi,

we are facing same kind of issue.

but we can configure outlook, if you allow user full rights temporary; configure outlook and then remove external in/out permission.

we are facing issue when other outlook users (same domain) tries to send mail to internal only user then it bounce with 'no such user here' error !!  from webmail we get desired results but from outlook or other email client (like printer or some erp portal) domain only user doesn't get mails.

are we missing any "smtp in" protocol  setting for this ??

SMTP OUT is not needed.

SMTP IN permission will be needed to submit messages using IMAP or POP clients, but this will also enable incoming messages from the Internet  You could create a block rule in your spam filter to discard the Internet traffic.

MAPI, EAS, and EWS will allow access from either an email client or a cell phone, but would allow you to disable SMTP IN.   (You did not indicate whether cell phone access was acceptable or not.)  All of these protocols operate over port 443, so if you allow webmail access from the.Internet, you also allow these protocols from the Internent.