Hi Malcom
We haven't implemented per-user protocol selection yet, but from 3.0.0 you can achieve the result you're looking for by setting the "Listening IP addresses" for each protocol. You can find these under the advanced settings for FTP/FTPS and SFTP/SCP. What you need to do is set the listening IP addresses for FTP to your LAN-facing IP address and leave the SFTP listening on all interfaces.
- Hans (EnterpriseDT)