Anything that needs to access the internet only has that access and to nothing else on the network. Anything that doesn’t need it only has access to the local devices it reports to.