TALK selection, who can call whom?

I have several users in my cloud. My employees are created as users and also external persons. Now I want to set it up so that my employees can communicate with each other employees via TALK, but cannot contact the external users. How can I set this up?