Hi, I suppose you have enabled persistent DNS resolving.
If you go to endpoint details of one of your users, put top domains resource (for netflow node) there and set it to display about top 20-40 domains. Because it shows just Top XX items, there is a high chance that internal domains will be those top 5-10, next in order should be those user visited outside your network.
You can also use traffic view builder to exclude your internal domains from endpoint detail view.
If you are not seeing external traffic, it is possible that you are not monitoring an interface that the external users are traversing. Just make sure the you are actively exporting flows via the device that sits between your service provide and your web servers (I assume the 7606, but make sure you are looking at the right interfaces).