It seems managed users appear to always use the external URL instead of local discovery. This seems odd… the whole premise of managed users is sharing within the home. Even though local DNS of the plex server hostname resolves to the internal IP, managed users still appear to be using external IP.
So, the fix was to create a NAT reflection rule for LAN > Ext IP to point 32400 back to the LAN IP of Plex Server