Yes, absolutely – just use connect permissions to control which nodes can connect to the chain, and for an extra layer of protection you can use your firewall hardware or software to limit access to the chain's peer-to-peer port to hosts within your Intranet.