Hi,
I created a private staff 'intranet' website on a web server using a subdomain. Technically it means it isn't confined to an internal private server but it still has restricted access control by using Concrete5 permissions. The advantage of using a web server is that the staff can access the 'intranet' area using an internet connection within the office or remotely. It worked well for my client but your requirements may be different.

Hope this is helpful?