Is driving me nuts.

I am testing open source ZIMBRA, and I really like it ..I am a total beginner but I begin to know the way it works

Now I want to give sales people access to the webmail in the most secure way.

So the first plan was to install 2 servers , 1 internal and 1 in DMZ.
Only the users created on DMZ can access webmail from outside, the others not...
But then I have a problem with synchronisation.

I got a hint by installing only 1 in internal network and install a kind of gateway server in DMZ. but I still have to figer this out..

What is now the most secure way to give access to webmail from outside the company.