That was exactly what I was looking for, thank you.

I have these locations defined in my server section:

location ~ ^/[^/]*$ { proxy_pass http://myinternalsite.com; }
location /subfolder { proxy_pass http://myinternalsite.com; }
location / { return 444; }

So http://externalsite.com and http://externalsite.com/subfolder both work but everything else fails.