Your router will probably have settings in it which can accomplish this fairly easily. If you supply a single computer to use on the intranet , then the gateway, modem or router nearest the incoming internet will probably have a firewall or filters on it which will include filters to keep individual computers out of your intranet or block individual computerss on your intranet from accessing the internet. You may even be allowed 3 ways to choose which computers get blocked: By MAC address, by network address or by computer name.
If your guests bring their own computers to use on your intranet it is still possible to block their computers and still let your employees use the internet. In a case like that you can use the same firewall where you can block all computers from using the internet. After blocking all computers you can use a white-list on the firewall and allow computers to choose back onto the internet. 95% of routers, modems and gateways have firewalls for blacklisting. 90% have tools for white-listing.