Lock down Exchange 2013 ECP to internal access only

I'm concerned about the ECP on Exchange 2013 being accessible from the outside world. Is there a preferred method of disabling access to ECP from the outside while still allowing OWA and everything else?

---

Vincent Sprague