That was very interesting ab.
Segregating the network based on subnet's is one way of doing it.
I assumed the server could make the segregation based on the internet zone.
Anyway, I will let the admin guys block the incoming and outgoing traffic on the firewall.
This is the safest option.