if you wanted to sandbox their access to the internet, why give them any physical access at all?