It is generally inadvisable to try to control access to a networked service by such a vague means. In practical pentesting, it is not unusual for the attacker to be able to possess, say, a networked printer or coffee machine, and use that as a springboard to perform requests on your service with 'local network' privileges. On a more philosophical level, if you're trying to divide customers as 'local' and 'foreign', it indicates you have not done a proper analysis of who has need for what kind of access. Systems thrown together without systematic analysis tend to err to the side of the accessibility aspect of data security, and such errors can lead to failure, sometimes massive, of the confidentiality aspect.
If you're developing what is essentially a single service, but with more access granted to your organisation's agents than to anonymous people off the Internet, you should set up some authentication mechanism, and distribute passwords, client certificates, OTP tokens, or some other means of secure identification to those people with specific need to access data you intend to not make publicly accessible by randos. In the context of Windows-based services, your users will probably already have entries in your Active Directory, and may have been configured to authenticate against it when they login in to their workstations. If your analysis suggests this level of authentication is appropriate for your service, you may, for example, configure your web server to request that users' browsers present Kerberos tickets when accessing your service, and determine the appropriate access level based on user identity in this way.
If analysis shows that what you're trying to do is better modeled as two distinct services, you may prefer to set up one service for public access, and another for the local network, perhaps with some sort of regular data migration process between their datastores. You'd still be well-advised to authenticate the people you consider 'local' before you give them any non-public data or accept commands from them you would not want to accept from randos, of course.