QoS management

we have astaro security gateway 220 V8.308. We have 10 VLANs configured as DHCP via astaro.

Problem:
1) We want to put cap over internet access via vlans or users (any user over any vlan).
2) Above rules should not be applied to vlan to vlan traffic (Dont want cap over intranet)