If a firm wants to setup ndMail but not expose their EWS to be visible to the internet they need to whitelist the netdocuments outbound IP addresses in addition to the normal setup.
US Data Center
EU Data Centre
AU Data Centre
Full Whitelisting article:https://support.netdocuments.com/hc/en-us/articles/205219820-Whitelisting-NetDocuments