> I have to deny some users to send / receive email to /from internet users ..
So simply delete their accounts. If a user can neither receive nor send
mail using his account, his account is completely useless.
> according to the above tcp.smtp configuration .. my users are still can send
> / receive email to / from internet users .. am I missing something?
Yes, a clean concept of what you need. Relaying doesn't have anything to
do with _receiving_ mail. Please be more specific when describing. Tell
us what should work. Tell us what should be prohibited. Give examples,
when they help clarifying your problem.