Limit OWA 2013 access from the Internet to only a group of users

I need to limit access to OWA (Exchange 2013) from the Internet to a group of AD users. TMG would provide this feature, I used before, but is not an option for me anymore.

I'm not sure if Windows Server 2012 R2 Web Application Proxy using ADFS provides this feature, that says WAP does only preautentication. What I need is an authorization solution to OWA for users coming from the Internet. OWA on the intranet must remain allowed to all users.