There's two ways.

1. Under the settings where you setup the AD Provider you can enter an IP address(s) or IP address range for systems you want to auto-login. If you give it a range for your internal network then only computers with that IP range will attempt to automatically login. Everyone else will be treated as a regular DNN user (they won't get the IIS login prompt). The only time I've seen problems with this is if there's an appliance on the network that pushes all connections from one IP address. If you look at your site log you should be able to tell how internal/external users are access your site.

2. Comment out the <add name="Authentication"... /> in your web.config. A side effect of this is that then all users are treated as regular DNN users (domain users will not be automatically logged in). For your domain users you can provide a link to http://yoursite/desktopmodules/authenticationservices/activedirectory/windowssignin.aspx and they'll be logged in that way.