However if someone appends "/index.php" or "/portal.php" to the subdomain, those requests are not redirected.
Good. That lets you kill two birds with one stone. Requests for "index.php" by name should in any case be redirected to the directory's proper name, which ends in /. (Redirect only the index filenames that you actually use-- php OR html OR htm or whatever it may be. The others can jolly well get a 404. They've earned it.)
So, as usual, you go from most specific to less specific to final mopping-up. The pattern is:
First:
RewriteCond looking at the desired subdomain
RewriteCond looking at THE_REQUEST for index.whatever, so you're only redirecting people who asked for the index file by name.
RewriteRule that redirects index.php to http: {et cetera} redirect.php
Second:
RewriteCond looking at THE_REQUEST for index.whatever, as above
RewriteRule that redirects anything else in index.php to http://www.example.com/{directory name, if any}
Every rule needs an [L] flag meaning "If you've applied this Rule, don't go looking for any others". Every redirect needs an [R=301] flag to make it a permanent redirect. The [R] by itself is pointless because giving the full protocol-plus-domain (which is the correct thing to do) has already turned your rewrite into a redirect-- but it defaults to 302. You rarely want that.
Gotta say I don't understand the reference to a Referer in your quoted rule. Where is the subdomain referenced?
