Q:

Secure login to a website on Azure with Windows authentication and username/password

I want to set up a website on Azure according to the following requirements and are wondering if it is even possible? 

As a internal team member, I must be able to login to the site with Windows Authentication
As a external customer, I must be able to login to the site with user name and password
As a external customer, I must not be able to access a subset of the site
As a unauthorized user, I must not be able to access anything on the site

I guess I have to set up a VPN connection between Azure and the Active Directory in my company.  How do I do that? 
Is it at all possible to meet my requirements? 
Background Information
We are a small project with about 10 team members.  
We have four large customers who need access to the site, and there are a few people in each customer who needs to have access to the site. 
Customers will just have read only access to static, non-sensitive information.  
The team members will have write access, and will also handle some sensitive information. 
** Edit **
I have now managed to create efficient synchronization of our projects local AD to Azure, thanks user18044.  Unfortunately, the accounts for the team members is located in the company's AD (corp.mycompany.com), and out AD has one-way trust with it. 
We have groups in the project-AD pointing to our accounts in the company's AD, but the members in the groups is not synchronizing over to Azure. 
Can this be solved? 

A:

Yes, I think what you are describing is doable. 
Your first two bullet points are about authentication.  As Azure Active Directory does not directly support Windows Authentication, federation is the way to go here. 
When you as an internal team member log on, you land on what is called a home-realm discovery page, where you pick the realm you want to authenticate in.  Picking the realm of your company, you get redirected to the STS (for example ADFS) your company has set up to authenticate you.  If you are in the same Windows Active Directory network as the STS is authenticating against, you should be able to use Kerberos to be issued a token. 
An external customer would be redirected to another STS that would use forms authentication against a credential store to issue security tokens. 
Both security tokens are then posted back to Azure Active Directory which is configured to trust both STS's and issues a token of its own.  See here for an example. 
As for the second two bullets, the authorization part you can do based on roles you assign to your users.  Depending on which STS authenticated your user, you assign them a certain role.  Based on that role you can give access to certain parts of your website or not.  How to implement this depends on what stack you are using for your web application, but a Google search should give you some leads.