I want to rewrite local addresses in mail that goes to the outside world, but not for messages that remain within the local intranet.

You can use the headers_rewrite option on a transport to do this. The rewriting will then apply to just those copies of a message that pass through the transport. The return_path option can similarly be used to rewrite the sender address. There is no way of rewriting recipient addresses at transport time. However, as these are by definition remote addresses, you probably don't want to rewrite them. You have to set up the configuration so that it uses different SMTP transports for internal and external mail. If you are using a single router in both cases, you could configure it like this:

dnslookup:
  driver = dnslookup
  transport = ${if match{$domain}{\N\.my\.domain$\N}{int_smtp}{ext_smtp}}

This example uses the int_smtp transport for domains ending in .my.domain, and ext_smtp for everything else. The ext_smtp transport could be something like this:

ext_smtp:
  driver = smtp
  headers_rewrite = *@*.my.domain \
       ${lookup{$1}cdb{/etc/$2/mail.handles.cdb}{$value}fail}
  return_path = \
    ${if match{$return_path}{\N^([^@]+)@(.*)\.my\.domain$\N}\
     {\
     ${lookup{$1}cdb{/etc/$2/mail.handles.cdb}{$value}fail}\
     }\
     fail}

This example uses a separate file of local-to-external address translations for each domain. This is not the only possibility, of course. The headers_rewrite and return_path options apply the same rewriting to the header lines and the envelope sender address, respectively.