Did you mean to MASQUERADE the Internal IP addresses with the Public IP address? To do this you can simply select the Rewrite source address (Masquerading) option in the Advanced section of the firewall rule.
You need to restrict the User's right from the Domain Controller it cannot be avoided from the XG. There is a way to implement User-MAC binding but you need to authenticate the Users to do that.
Please refer the following KB articles for further details:
Hi, well, if you have a SMALL network, you can create a firewall rule allowing only the MAC ADDRESS registered that you can get from DHCP LEASES and create a IP group with them...
But this will become extremely hard to maintain if your network is big, or provide wifi for visitors for example...
