How do I configure Exim so that it sends mail to the outside world only from a restricted list of our local users?

You will need to have a convenient way of checking the list. If it is only a handful of users, you could just list them inline. Otherwise, you need to put them in a file or database. Let's suppose you've just got a list in a file. Put this as your first router:

check_outgoing:
  driver = redirect
  domains = ! +local_domains
  senders = ! : ! lsearch;/etc/permitted/senders
  allow_fail
  data = :fail: you are not allowed to send outside

The senders should be listed as complete addresses, with both a local part and a domain. For a large list, use a DBM or cdb file instead, or a database. The first item in the senders list is empty, to match the empty sender. This is necessary because bounce messages have null senders.