If a firm wants to setup ndMail but not expose their EWS to be visible to the internet they need to whitelist the netdocuments outbound IP addresses in addition to the normal setup.
US Data Center
EU Data Center
AU Data Center
DE Data Center
Full Whitelisting article:https://support.netdocuments.com/hc/en-us/articles/205219820-Whitelisting-NetDocuments