Yeah, just reject any access from their subnets