<p>I have a Web Service (ASMX) with a few Web methods on our production Web server.  On a separate internal Web server (which isn't publicly exposed) I have another Web site that will use the ASMX's public web methods.  What are some of the best ways to secure the Web service such that only the internal Web server can access the Web Services running on the publicly exposed Web server?</p>

Assuming you don't have the option of using WCF, I'd advocate using WSE 3 (Web Service Enhancements).  You can get the toolkit / SDK thingummy at
MS's site
To limit the access to only internal machines (as I think your question asked), I'd set up a separate web site in IIS and set it to only respond to the internal IP address of your server.