How to Deny Root, Allow Specific Users on internal subnet, and Allow Groups from external, On SSH/SFTP

Question

In Centos 7, What should our sshd_config look like to: Deny Root AND Allow Specific Users(not in group) on internal subnet, AND Allow Groups from external? Question is very specific!

Result we want: External ssh/sftp connections for our customers to land in their own Home/Root directories specific to them. But do not want employees to access from external, only from internal subnet. Because employees have greater access to folder structures.

These are the configs we have been using, but they do not work nor do they make sense as the documentation does not elaborate enough.

1.This Config should allow bob and trev internally, and allow sftpgroup. Instead it Allows the sftpgroup but does not allow other users: (bob trev are not in the group)

Match Address 192.168.1.0/24
        AllowUsers bob trev
Match All
AllowGroups sftpgroup
PermitRootLogin no

Documentation says these commands are processed in this order: DenyUsers, AllowUsers, DenyGroups AllowGroups.

2.So if they are processed in this order then the below should work but it does not (bob and trev have no access), so what is the point of ordered processing, if the later command does not overide the previous. shouldn't it Deny All and then allow specific users. but it does not. I feel like either this is buggy or the documentation is incomplete.:

DenyUsers *
Match Address 192.168.1.0/24
        AllowUsers bob trev
Match All
PermitRootLogin no

The Match Address Command works I have tested it.

Answer 1

This is the config edits to sshd_config that delivers the desired result in the Question. Allows specific Users Internally, Allows specific Group Externally, but denies Groups Internally and Specific Users externally:

Match Address 192.168.1.0/24
        AllowUsers bob trev
Match Address *,!192.168.1.0/24
        AllowGroups sftpgroup
Match All
PermitRootLogin no