This is covered in the FAQ for the AGPL:
Q: How does this license treat commercial enterprise use over intranets and internal networks?
A: Simply, if run internally to a commercial company, then the company isn't required to release source code back to the world. The license requires that if a user downloads the source they have the right to make improvements and not release these modifications. GNU GPL software in general addresses this issue the same way. If an employee has access to the source and has the right to make improvements, the commercial entity could probably view this work as work for hire and owned by the company and not have to be released outside.
The realization here is that you, the company are only distributing the application to yourself in effect. This means that you don't need to publish the code changes back to the public.
The AGPL is intended to force the public web apps (Google and the like) to publish their changes that use licensed software that is available to the public back to the public. But, if the use is completely behind the corporate firewall and used only internally to the company, there is no requirement that the code be released back to the public because it is never distributed to the public as a webapp.
So no, you don't need to advertise to the public that you have modified the program, nor do you need to publish the modifications. What is behind the corporate router stays behind the corporate router. You, the company, are only distributing it to yourself; and you, the company, already have the source code and its changes.
Note that you would still be required to have your employees able to download the source of the original application, though it doesn't appear that you would need to make the modifications available.
Again from the FAQ:
Q: Can a commercial entity remove the download source button in a corporate intranet or internal networked environment?
A: No. Anyone who wants to use the software in a corporate intranet or internal network, must leave the download source button but doesn't have to make modifications available if not engaged in distribution. Anyone engaged in distribution beyond their enterprise must leave the download source button in place and make available the source for any modifications through this button.