What you ask is possible but probably not practical. At least Windchill PDMLink was not written to function this way. For discussion purposes, let's assume you have internal and external access.
When a user logs in, Windchill calculates their access based on their login username. So, each user would need two logins to Windchill (internal and external) to have different access permissions. Licensing can be configured to allow this but it feels like a lot of administrative overhead for little to no value.
To complete this scenario, login restrictions are implemented via Apache. Windchill's internal Apache instance can be configured to restrict access to an 'internal users' LDAP filter group. We can limit Apache by IP address but it won't define permissions by internal/external access. Only place internal usernames in the 'internal users' group.
Implement a reverse proxy and configure Apache with an 'external users' LDAP filter group for external access. Again, only include external usernames in the 'external users' filter group.
Is your request to limit access to explicit components ("controlled parts")? PDMLink is designed to limit access to entire classes of components (e.g. Documents, CAD Documents, WTParts). To limit access at the individual object level, consider implementing security labels or ProjectLink.
