Under the GPL, if it has been distributed internally, then only those local users have the right to demand the source. The fact that one set of users has access to the product (and also the source) in no way affects any users not in that set. There is nothing in the GPL that says you have to make the product available to the whole world. It just says that if you do make it available, then the source has to be made available too.
I have no idea if "making available" is to the individual or to the company for whom that individual works. But I'm not sure it matters. If they are using it as part of their job, then just put your foot down and say that they are not allowed to touch the source on company time. Since it was never distributed to them as individuals outside of work, just as employees, then I think you're safe.
But this all begs the question: What are you trying to gain from this? Just grant them access and be done with it. Prohibit them from touching the source while on the clock, but let them do whatever they want outside of work. Who knows, one of them just might make the product better for everyone.