A second method would be to have the proxy act as the root server within a large organization. The third way is to install the proxy as a filter in some sort of dynamic packet filter. The packet filter could intercept outgoing DNS queries and kick them up to dnsproxy for processing. Each of these three schemes has its advantages and disadvantages. The third scheme is likely the best.
Insiders see the same image of the world as do outsiders.
NS records need not be deleted, save for those that refer to the inside domain. The problem is that this deployment mechanism is very dependent on the details of your firewall. There are then two sets of root servers, the outside's and the inside's. A laptop that lives in both worlds would need two different configuration files. It would be least intrusive to use local resolv.conf files or forwarders entries in named.boot files is the least intrusive mechanism.