Same zone, separate views, on different servers

[Sasso, John IT]

Say you have a domain xyz.com, and you want to configure two different
nameservers to provide name records for the zone: one for non-public records
just for the private network, and the other for public records accessible
from Internet hosts.  The private nameserver must not be accessible from the
'net, although the public and private nameservers should be able to talk to
each other so the public one can pass resolved Internet names to the private
one (i.e. those that the private one requested), including names in xyz.com
that are publicly accessible but the private nameserver is not authoritative
for.

Is such a configuration possible?  If so, could someone refer me to info on
how to do this.  Thanks!

--john