Use the same instance of MindTouch as an Intranet and an Extranet

1) Restrict MindTouch to require Login

The first thing to do is make sure that your MindTouch install requires a login in order to access any content.  This can be done by going into the Control Panel -> Users and editing the Anonymous user and setting the role to None.  Once you have done this then any user that goes to your MindTouch site will be required to login.

2) Change Default Role for New Users

The next thing you want to change is the default role for a user to Guest.  Note if you don't have a Guest role, you just need a role that has Login checked.  This will lay the foundation to allow the users to get their permissions for the site based off of the group they are in.  You can change the default role for a user by going into the Control Panel -> Configuration -> Advanced Config    and then changing the following key's value from Contributor to Guest:

security/new-account-role

3) Configure Groups

Once you have that setup then go into the Control Panel -> Groups and setup groups that will allow you to segment out the internal groups that will have access to the Intranet and the External Groups that will have access to the Extranet.  Note that there may be overlap as far as pages that both groups can access.  Once you have the groups setup then you'll segment out the pages that you only want the External users to see and the ones you want the Internal users to see.

4) Give view access to the Home Page

Next make sure that you give viewer rights through the Restrict Access section for the Home Page so that when the user logs in they will be able to see the Home Page.  

5) Make user pages writable 

The last piece is to make sure that the individual users are able to add content to their user pages.  This can be done by adding the following configuration to the Control Panel -> Configuration -> Advanced Config  and set the key to Contributor

 security/homepage-grant-role

Note that the homepage-grant-role will only work for newly created users so you may have to go to the individual user pages and grant them access to it, if they don't have Contributor rights to the site.  

Congrats!

Once you have done this then you will have an appropriately locked down MindTouch install that will allow you to open it up for External users to collaborate on the site along with keeping your internal information accessible to the right group.