This is a very common setup. In general, never use .private and .local since you end up (eventually) in a world of hurt and doing it "right" isn't that hard.
Basically, you will tell the world that your mail server resides on the public IP address (or set up it's own real routable internet IP address and have the Proxy/Firewall forward traffic to the internal fixed IP 10.1.1.20)
Then, you will add two zones to your internal DNS so that all queries for mail.whatever.com resolve to 10.1.1.20 and a reverse zone resolves the IP to the name.
This way your clients will get the right address when on the local LAN or VPN in, but can still access the server from the public internet when DNS gives the public address.
Also look out for your server certificates. Most people issue certificates for the public IP address and have a profile to allow internal clients to trust a self-signed cert for when they hit the server locally.
There are no silver bullets here - the choice you make to have a more complicated routing will complicate your SSL and other server setup steps, but this is a common situation for people deploying lion server so I've seen it work well in most cases.