Put a (Deciso or other) opnsense router in front of everything and use that to control exactly what can talk to what and what can talk to the outside world.