Do you receive any federal funding, possibly funnelled to you through a state agency? If so, you will have an AAP on file somewhere that will outline what you are doing to get a wide array of applicants. Posting exclusively internally may not be in line with what you say you do in your AAP if you have one, so I would definitely check that out. In general, I think it's better to post internally and externally because if you post internally and hire nobody and then post externally, people often feel more rejected than if they were considered in a large applicant pool to begin with including both internal and external job seekers.
Outside of the aspects tied to your Company's status as a non-profit, which brings in a lot of federal burdens if you have an AAP (which you do if you accept federal funding), the law doesn't really address where you get your applicants from. Internal applicants, external applicants, calling up applicants from the past, and unsolicited resumes/applications given to you are all perfectly legal.