If a firm wants to setup ndMail but not expose their EWS to be visible to the internet, they need to add the NetDocuments outbound IP addresses to inclusion list in addition to the normal setup.
US Data Center
EU Data Center
AU Data Center
DE Data Center
Full Inclusion list article: https://support.netdocuments.com/hc/en-us/articles/205219820-Adding-NetDocuments-to-Inclusion-List