Palo Alto Firewall - Allow Internet only after HIP fail (no access to intranet)

I am looking to configure the firewall rules where if a known user fails the HIP posture check, the user has access to only the internet, and not the intranet.

I currently have the rules configured such that failing the HIP check allows the user to access to both the internet and the intranet. We tried blocking RFC1918 in the destination address field, but this blocks my proxy servers that all outward-bound traffic must go through. 

​

Any ideas?