Granting access for domain users to area, but not forms authenticated users

For our extranet User Portal, there are two types of users:

• Employees who log into the site via windows authentication


• Customers who log into the site via forms authentication

I'd like to create specific areas (i.e. pages or or subsites) that only employees can see. Normally I would secure this by a group, but anyone on the domain controller can log on, and there's no common group that all the employees belong to (from what I can tell) in AD. It is guaranteed that all domain accounts will be employees, however.

I'm using the default SQL Server membership provider with no customizations for my customers. Any ideas on how I can control access to employees without a lot of manual intervent? (i.e. adding all external employees to a new group).

SharePoint 2013 on-premise