What you need to do is the following:
- Create a Deny Web Publishing Rule for the public name owa.domain.com. After you finish the rule, go into the properties of the rule and configure a redirect to https://owa.domain.com/exchange
- Create an Allow Web Publishing Rules for owa.domain.com using the Mail Server or Exchange Web Services publishing wizard (depending on the version of the ISA firewall that you're using). Put this rule right under the Deny rule you created.
Pretty easy and it works a treat!