How to restrict access to external facing portal?

Hi experts,

we want to use our portal from internet zone, but we don`t want admin users or service users to be allowed to log on the portal from the internet zone.

Only "normal" users should be able to connect from the internet zone.