Not a very standard configuration for an email gateway, but for starters, you may want to setup another listener for the internal to internal traffic. I'm thinking like a firewall configuration here, but I don't think this will work the way you want it too.
Another method that might be a little better if you have the resources (VMware or something similar), is to setup another virtual appliance, use clusterconfig to make configuration much easier, and create a cluster group for appliances that will be filtering your internal traffic, while keeping your gateway appliance configurations focused on filtering incoming and outgoing e-mails. There are no extra licenses to purchase, just need to setup your virtual appliance license fie if you don't already have one.
Personally I use Exchange, and there are plenty of ways to filter and control traffic with transport rules internally, but you may have some specific requirements that require a little extra filtering.
which type of listener (private/public) you would like to send your internal traffic would also depend on the filter requirements. If it is just DLP and the likes as if you were sending it out to the public, then probably a private type of listener.
