Since I only have two circumstances (internal and external) the hidden categories thing makes sense. If I had any more, I'd really be looking for a more detailed solution.
Essentially I just created a role called Internal Student who has access to hidden categories- of which there is only one entitled "internal content". Everyone else is listed as a regular 'student' role and this sufficed for my needs.
Can anyone thing of a reason why this wouldn't hold up?