If I'm understanding this correctly, you have the following questions:
01 - What to do when duplicate tags are shown, but don't match the criteria?
02 - If a tag "Internal IP" leaves and should then be "External IP", does this happen automatically?
03 - What if the automatic epo tag ninja doesn't work?
my personal opinions:
01 - I have seen this in my environment. The cause I don't know exactly, but I just clear ALL applied tags for that system and let the next ASCII re-determine the matching criteria.
02 - If you have your criteria set properly AND have the tag criteria to check on EACH ASCII.
03 - If the tags aren't working properly, you could always create two System tree groups -- Internal Assets, External Assets with the IP criteria for the group. Then just make sure to setup an Auto-sort every so often.