The way I see it you have two options..
You must have an MTA and either a pop3 or imap server, from there your options differ.

A.) You will need an MTA that supports smtps, and either an imaps or pop3s service, this is the likely scenario if you want to have them connecting using their own client e.g. Outlook or Thunderbird.

B.) If you want to go the web based route you can integrate a web based service on top of your MTA/MTC server and just run that local process all over an SSL based webserver. This method is in my opinion significantly less hassel as you have less interaction with the users, always a plus in my book. Upon connect to your https:// your users will get a box warning them of incorrect verification, if you self sign your key.

If it were me setting it up, these would be the options I would go with, pick your own poison though....

OpenBSD http://www.openbsd.org offers a sendmail(MTA) solution that by default only allows local connections.
OpenBSD also comes with a pop daemon, and Squirrelmail available from http://www.squirrelmail.org Also, you'll have to turn on SSL for the apache webserver.