Is it possible to prevent Host and Admin users from logging in externally, that is from outside a company intranet?

This is actually a very good idea !!

I think now it cannot be done without modifying the source-code, but that is why we LOVE open-source isn't it?

My suggestions:

1. Modify UserValidStatus.vb, add
EXTERNALIP = 5
right after the line:
UPDATEPASSWORD = 4

2. Modify Login.ascx.vb (I'm not an expert in Visual Basic, so excuse my mistakes. I'm more in C# world)
right after
            If Not objUser.IsSuperUser Then
                validStatus = UserController.ValidateUser(objUser, PortalId, ignoreExpiring)
            End If
add something like this:
If Not Request.UserHostAddress().StartWith("192.168") Then validStatus=UserValidStatus.EXTERNALIP

3. Handle the UserValidStatus.EXTERNALIP in the Select just below I suggest adding something like this:
                Case UserValidStatus.EXTERNALIP
                    strMessage = "Admins can login only from inzide the corporate network!"
                    AddLocalizedModuleMessage(strMessage, ModuleMessageType.YellowWarning, True)
                    PageNo = 0

Hope this helps.

Great, this is exactly what I was talking about, thanks Ion.