Every system has a nobody account under which httpd etc run. I would like to know how to restrict mail which comes from that account to users on that host only.

Set up a first router like this:

fail_nobody:
   driver = redirect
   senders = nobody@your.domain
   domains = ! +local_domains
   allow_fail
   data = :fail: Nobody may not mail off-site

This assumes you have defined +local_domains as in the default configuration.