vlan with firewall rules to block it from the rest of you network. look at traffic logs every once in a while to see if anything weird is going on.