Hello Miguel,
ACS 4.x does require External Database IP address when using Windows. If you want to authenticate AD with ACS 4.x you need to have the ACS software (if using Windows version) installed on a Member Server or Domain Controller on your network.
If you are using an ACS Solution Engine then the Remote Agent software must be installed on a Member Server or Domain Controller on your domain.
The ACS Software would then detect the available domain and should be able to authenticate AD accounts.
You can check the following for the Post Installation Tasks for an ACS for Windows:
http://tools.cisco.com/squish/D3998
Hope this helps.
Regards.