Are you using an authentication system? If you are, you should identify the user as part of one of you workgroups.
When a user access a 'sensitive' portion of your intranet, use PHP to verify that the user is:
A) Authenticated
😎 Authenticated as a member of the group / groups that have access to that part of your intranet.
If either of these tests fail, deny them access.
If you're not using an Authentication system, I'm not really sure that you know what you're doing.