You could plant a host file on the client and have the system check it
for DNS first.

Problem is that the user might be smart enough to simply change DNS
servers or to set the system to check the local one last.

Another thing to try would be hosts.deny / hosts.allow

Aside from that you might consider examining your /etc/named.conf and
decide which file referenced therein refers to your internal net.

Mine can be found in /var/named/ and since my internal domain is
microverse.net the file is /var/named/microverse.net.db but I probably
shouldn't and/or couldn't use this file to specify anything outside my
internal net.

You could create an additional db file from scratch and add it to your
named.conf so that that it wont get sent to the forwarder.

You might also consider a fake forwarder in named.conf