VLAN your devices, and deny and outside route, if you can.