You can learn from TSMC or power grid networks. These networks are highly secure and must be separated into internal and external networks. There shouldn't even be any chance for the external network to access the internal network.

Of course, physical ports are also a risk, but they're easier to detect. At least someone has to come in.