Restrict GTM to only allow replies for external users to certain zones

I have a GTM which has many zones configured, some of the resource records are in zone runner and some in Wide IPs pointing to LTMs.   I want to restrict external (internet) users to only be able ...