... prevent users from specifying internal URLs and only specifying servers accessible through the external internet?
I doubt that this is securely possible to proactively filter user input for this. An attacker can easily setup a DNS server which points to some internal IP address or domain, either by A/AAAA record or by CNAME. And given that this DNS server is controlled by the attacker the result of the DNS resolution might be changed whenever the attacker likes.
This means that to check only when entering the domain is not sufficient. Instead the check need to be done whenever the service uses the user-controlled data, i.e. whenever the user-specified URL is accessed and the domain name gets resolved in this process. See also Time-of-check to time-of-use bugs.
The web server might have access to parts of our internal network or some services might be running on localhost.
It might be easier and more secure to fix this design. For example one might put the service inside a container with no other services inside and allow only access to the internet for this container. This approach would provide robustness even against bugs in the application since by design no access to internal sites would be possible.
Another (less secure) option would be to setup a DNS resolver like dnswall which only returns external IP addresses and make sure that only this server is used by the application. Of course one need also be sure that no direct IPv4 or IPv6 can be specified by the user.
A similar approach is to enforce the use of an external proxy server which just based on its location can only access external sites.