Semi-complicated Postfix/firewall config question
 

I've added a couple of user accounts to my machine so my friends can log in and "play around" (practice programming, learn Linux, etc). I have Postfix 2.1.5r2 and pine installed. Here's what I want:

1. Users should be able to send messages to each other (local account-to-account mail).
2. Users should NOT be able to send mail to the "outside world," i.e., no mail should leave the local machine.
3. My account (and root) SHOULD be able to send mail to the world.

Am I asking too much? If not, should I be looking at tweaking Postfix, my firewall, both or something else entirely?

This is just an off-the-wall sideways idea, I know how to do this using the Exim mailer, which is probably easier to configure anyway. I'm not saying one is better. If you switch to Exim, or at least co-install it for a trial, its a fairly simple matter to alter the routers so only your account can send mail.