Restricting legitimate user access to share when connecting via server website instead of SMB?

[cameronjpu]

I think the subject probably says it all, but to further explain: for security reasons, we need users to be able to access one particular shared folder only when they are in the office, not when they are offsite. thus I want them to be able to access it via SMB but not the web interface. Is this possible? Advanced permissions doesn't seem to give me the capability I need. Thanks.

Edit: maybe is the answer to allow ONLY LAN access to those users, and then create new identical users that have web interface access but lack the access to the secure folder? Is that option doable?