To configure access permissions for the XoWiki please see XoWiki Security Management
As you can see from above website, access is managed using a policy that is implemented on a code level as a tcl class. This class is located in ~/packages/xowiki/tcl/package-procs.tcl
As you will see ther are several specification options to define a right.
While specifications 'login' and 'admin' are rather self-explaining, specification options
To limit access to the internal employees only, you would need revoke the package permissions from the XoWiki package.
They are usually 1nherited from the main page.In order to revoke them, please go to ADMIN->SITEMAP to manage the permissions of the XoWiki package.
Next remove the inheritance:
... and re-add the relevant permissions for the group 'Employees' to the XoWiki package: