Block External Outlook Web Access only for few users

I am not sure if there is a setting, but you can script it with PowerShell and schedule the script to run at the time you want.  I do not think you can control from exchange to allow internal, but not external.  It is on or off for this feature.

I would create a group in AD and add the users you need to restrict.
From there combined both AD Powershell and Exchange PowerShell.

You will need two scripts one to disable for the weekend the other to enable.
I tested this and it worked, but it did force me to re-authenticate to my Outlook App.  I am not using the native Mail App.

This should be run from your CAS Server.
Disabled:

Import-module ActiveDirectory

Get-PSSnapin -Registered | Add-PSSnapin


Get-ADGroupMember -Identity <GroupName>  | %{Set-CASMailbox -Identity $_.sAMAccountName -ActiveSyncEnabled $False}

Select all Open in new window

Enabled:

Import-module ActiveDirectory

Get-PSSnapin -Registered | Add-PSSnapin


Get-ADGroupMember -Identity <GroupName>  | %{Set-CASMailbox -Identity $_.sAMAccountName -ActiveSyncEnabled $True}

Select all Open in new window

Once created open Task Scheduler and create two task to run at the time you wish to disable and enable.  Remember that you need to use powershell.exe with the argument <Script file Path>