If the users are using the same account to access the documents in both cases then it's not going to work. You can't under normal circumstances change ACLs. If however they were connecting into the network to work on the documents you could probably create NAP policies to restrict access, but that would require a NAP solution deployed or possibly done with Win RMS if there is an active directory environment in play.