@Scott Powers,
Your concern is more towards the "AdminEnabled" attribute of the ECP virtual directory. If it is set to "false", it can only be used by users to manage their settings. Thus setting it to "false" resolve both issue #1 and #2 because,
1. ECP site is available from the outside but will only show the user settings
2. External OWA users can manage their setting since #1 is resolved.
So, in addition to the steps in the blog,
1. Set "AdminEnabled" attribute to "false" for your default ECP (accessible via internal and external network).
2. Set "AdminEnabled" attribute to "true" for the secondary ECP (accessible via internal network only).
3. Use the secondary ECP to manage the server.