|There are a few kinds of separation. In the most strict sense no amount of hacking or editing of the settings would let the two connect. |
I would suggest that you create a single lan for all the official business computers Then use a very limited set or single internet connected one. Then you have to watch out for people using flash drives to spread virus.
If not use something like a firewall or router based on hardware or a software one that can limit based on what you want.
1/3 of highway deaths are caused by drunks. The rest are by people who can't drive any better than a drunk.